Dsh Profile Lock Proof
dongsheng123132/dsh-profile-lock-proof · skills
It is deliberately narrower than an SBOM, CVE scanner, signature verifier, or installer.
★ 2GitHub stars
0Forks
2026-09-07Last updated
JavaScriptLanguage
MITLicense
Key features
- Input paths are workspace-relative regular files
- traversal and symlinks are rejected.
- Profile and lockfile bytes must match the SHA-256 values in an explicit proof manifest.
- Dependency specifiers must be exact semver or github:owner/repo# .
- Missing, stale, invalid, mutable, mismatched, or lifecycle-script-bearing evidence fails closed.
Install command
dsh plugin --profile web add github:dongsheng123132/dsh-profile-lock-proof