dsh-reproducible-build-proof
离线的内容寻址证明，证明独立构建复现了字节级完全相同的指定制品
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:dongsheng123132/dsh-reproducible-build-proof#da2628608616e9d08ade4eac8213eabc5fea0b49Reproducible Build Proof 以 dsh-reproducible-build-proof 发布，当前版本为 0.1.1。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
An offline, deterministic evidence layer for DeepSeek Harness supply chains. It checks whether two or more independently operated builders recorded the same source revision, recipe, build type, parameters, dependency set and relevant environment contract, then produced byte-identical specified artifacts.
It does not execute a build, install a package, authenticate provenance, issue a SLSA Verified Property, or claim protection against source, dependency or distribution threats. It verifies explicit hash-only receipts; use a provenance/signature verifier to establish receipt authenticity.
dsh-release-proof checks multiple download endpoints for HTTP status, length, version and SHA-256 agreement.dsh-attestation-proof verifies DSSE/in-toto signature, subject and signer-threshold policy.This follows the narrow reproducible-build definition of bit-for-bit identical specified outputs and the SLSA distinction that verified reproducibility requires two or more independently operated build platforms. It does not conflate reproducibility with total supply-chain security.
dsh plugin add github:dongsheng123132/dsh-reproducible-build-proof#COMMIT
The bundle exposes dsh_reproducible_build_inspect and dsh_reproducible_build_verify from one headless core. The independent MCP stdio server exposes reproducible_build_inspect and reproducible_build_verify. The CLI accepts inspect or verify plus an explicit JSON path.
See examples/reproduced.json. Reports contain only hashes, sizes, counts, booleans and verdicts. Secret-shaped material, raw logs and body/content fields are rejected. The DSH verify tool reads a workspace-relative non-symlink manifest, writes only to an explicit workspace-relative artifactDir, creates deterministic content-addressed output exclusively, and verifies it by read-back.
npm test
npm run check
npm run smoke:plugin
npm run smoke:mcp
python C:/Users/YOU/.codex/skills/.system/plugin-creator/scripts/validate_plugin.py .
Node.js 22 or newer is required. The verifier has no runtime dependency and makes no network request.