@hot-updater/rock
React Native OTA solution for self-hosted
2
Versions
MIT
License
No
Install Scripts
Attested
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation (unverified)
npm registry signatures
No source commit
Maintainers
gronxb
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Transition to GitHub Actions publishing with SLSA attestation; legitimate CI/CD migration by original maintainer. | ai | |
| provenance | no-provenance | AI (provenance): Established package with consistent publish history; lack of provenance is common and not a risk signal here. | ai | |
| dependencies | unvetted-dep:@hot-updater/plugin-core | AI (dependencies): Sibling package from same hot-updater monorepo; pinned to matching version, consistent across all releases. | ai | |
| dependencies | unvetted-dep:@hot-updater/cli-tools | AI (dependencies): Sibling package from same hot-updater monorepo; pinned to matching version, consistent across all releases. | ai |