zinggai/zingg: technical due diligence, read from its repository

30% of commit subjects are exact repeats of another subject, and subject length varies by only 21.1 characters. A log written by someone explaining their reasoning to a future reader does not look like this. The log is therefore weak evidence of intent, whatever the code is like.

Dependency versions are declared as ranges and no lockfile is committed, so a build today does not necessarily produce what a build last month produced. That matters twice over in a transaction: the thing being bought cannot be reproduced exactly, and a compromised upstream release arrives without anyone choosing to take it.

2 places read data with a deserialiser that executes what it reads (Java object streams). That is safe on data the system wrote itself and remote code execution on anything else. Ask where each one's input comes from.

Third-party code is committed into this repository without any statement of the terms it arrived under. Unknown terms are harder to deal with than inconvenient ones: an awkward licence can be complied with, an absent one cannot. Each of these needs its origin established before the code changes hands.