Software Passport · public repository

SUSE/rmt

Observed by SPR on 2026-09-16 at commit 30516e92f1eed68a3de15bc7dd91fe04214bb816 (master). Source: github.com/SUSE/rmt.

SBOM components167
Open findings176
Critical / high2 / 6
Evidence items169

What was observed

Syft generated the software bill of materials from the repository's manifests; each component was checked against the OSV vulnerability database; the tree was scanned for secrets, infrastructure-as-code issues and licence signals. Vendor-supplied attestations: none — this page contains only independent observation.

Open findings (top 25 of 176)

SeverityFindingComponentFixed in
CRITICALGHSA-4rch-2fh8-94vwmysql2@0.5.7
CRITICALGHSA-fpw7-j2hg-69v5mysql2@0.5.7
HIGHGHSA-3f6p-5ww8-9rcrmysql2@0.5.7
HIGHGHSA-pmh2-wpjm-fj45mysql2@0.5.7
HIGHGHSA-w3w8-37jv-2c58mustache@1.1.1
HIGHGHSA-3c6g-pvg8-gqw2json@2.7.6
HIGHPrivileged container enabled
HIGHHard-coded credential assignment
MEDIUMLicense not observedzstd-ruby
MEDIUMLicense not observedzeitwerk
MEDIUMLicense not observedyard
MEDIUMLicense not observedyabeda-rails
MEDIUMLicense not observedyabeda-puma-plugin
MEDIUMLicense not observedyabeda-prometheus
MEDIUMLicense not observedyabeda
MEDIUMLicense not observedwebmock
MEDIUMLicense not observedversionist
MEDIUMLicense not observedvcr
MEDIUMLicense not observedunicode-display_width
MEDIUMLicense not observedtzinfo
MEDIUMLicense not observedtyphoeus
MEDIUMLicense not observedtins
MEDIUMLicense not observedtimecop
MEDIUMLicense not observedthor
MEDIUMLicense not observedtext

Get the full passport

Continuous verification, evidence ledger, plain-English and auditor reports, and a shareable signed passport are available to SPR customers.

See plans   Review your own repository free

Software Passport Registry Ltd. Every number on this page was observed by SPR's own scan of the public repository at the commit shown; nothing is estimated or vendor-supplied. Absence of a finding is not proof of safety. Terms · Privacy