dsh-audit-bundle DSH plugin

dsh-audit-bundle is a DSH plugin that verifies a subject/revision has enough pinned evidence from independent producers to cover declared controls. It uses an explicit manifest with SHA-256 pinned evidence files, JSON pointers, and value-hash assertions. The plugin fails closed on missing, stale, or invalid evidence and outputs a deterministic SHA-256 pair-tree Merkle root.

security-policy developer-tools

How to install the dsh-audit-bundle DSH plugin

dsh plugin --profile audit-bundle add github:dongsheng123132/dsh-audit-bundle#<commit>

This source command needs manual review. Copying does not run it.

dsh-audit-bundle DSH plugin data source

dsh-audit-bundle DSH plugin snapshot date: Aug 16, 2026

discovered

What the dsh-audit-bundle DSH plugin can do

Verifies evidence coverage against a manifest with minimum eligible evidence, distinct producers, and allowed evidence types.
Pins evidence files by SHA-256 and binds them to subject/revision via JSON Pointers.
Rejects symlinks, path escape, oversized input, and excessive structure; performs no network calls or child processes.
Outputs a content-addressed JSON index under a specified artifactDir with read-back verification.
Emits deterministic SHA-256 pair-tree Merkle root without copying evidence bodies or assertion values.

Where the dsh-audit-bundle DSH plugin fits

Audit compliance: ensure that a software release has sufficient evidence from independent sources to meet security controls.
CI/CD pipeline: verify that evidence artifacts are present and unchanged before deploying to production.
Multi-producer evidence aggregation: collect and validate evidence from different teams or tools in a single verifiable index.
Regulatory reporting: generate a tamper-evident audit trail that can be submitted to auditors.

Who the dsh-audit-bundle DSH plugin is for

Security auditors who need to verify evidence chains across independent producers.
DevOps engineers integrating verifiable audit checks into DSH workflows.
Compliance officers requiring a deterministic, content-addressed audit index for evidence coverage.

dsh-audit-bundle DSH plugin limitations

Requires Node.js 22 or newer.
Only processes workspace-relative regular files; symlinks, path escape, and oversized input are rejected.
Does not perform network calls or spawn child processes; evidence must be locally available.
Not an SBOM scanner, signer, audit logger, or policy engine; it only verifies pre-existing evidence against a manifest.

dsh-audit-bundle DSH plugin: from the repository README

Quoted from the dongsheng123132/dsh-audit-bundle README, the upstream source of the dsh-audit-bundle DSH plugin. Copyright remains with the original authors.

Content-addressed audit indexes across independent [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) evidence producers. This plugin is not an SBOM scanner, signer, audit logger, policy engine or archive. Existing tools already scan dependencies and individual 2Origin plugins already produce release, runtime, recovery, lineage and policy evidence. The missing layer is a small verifier that proves a particular subject/revision has enough pinned evidence from allowed, independent producers to cover declared controls. ## Contract An explicit manifest declares: - one subject ID and revision; - required controls with minimum eligible evidence, minimum distinct producers and allowed evidence types; - evidence files pinned by SHA-256; - JSON Pointers that bind every evidence file to the subject and revision; - value-hash assertions, so expected or observed values never enter the audit index. Verification fails closed for missing, stale or invalid JSON evidence, subject/revision mismatch, failed assertions, disallowed types, insufficient evidence or insufficient independent producers. The output contains IDs, types, producers, paths into JSON, hashes, statuses, cover

Read the full READMERepository license: MIT

dsh-audit-bundle DSH plugin questions

How do I install dsh-audit-bundle?

Use the DSH plugin command: `dsh plugin --profile audit-bundle add github:dongsheng123132/dsh-audit-bundle#<commit>`. Replace `<commit>` with a specific commit hash. After adding, you can verify the installation with `dsh --profile audit-bundle --dump-config`.

What Node.js version is required?

Node.js 22 or newer is required. The plugin's CI runs on Ubuntu and Windows, and the package.json specifies Node.js >= 22. Make sure your environment meets this requirement.

What does the plugin output?

The plugin outputs a single JSON object containing IDs, types, producers, JSON pointers, hashes, statuses, coverage information, and a deterministic SHA-256 pair-tree Merkle root. It does not copy the evidence bodies or assertion values into the output.

Can I use this plugin to scan dependencies or sign artifacts?

No. The plugin is not an SBOM scanner, signer, audit logger, or policy engine. It only verifies that a set of pre-existing evidence files meet the criteria declared in a manifest. For scanning or signing, you need other tools.

What happens if the verification fails?

Verification fails closed on missing, stale, or invalid JSON evidence, subject/revision mismatch, failed assertions, disallowed types, insufficient evidence, or insufficient independent producers. The CLI exits with code 2 for a failed audit verdict, and code 1 for invalid usage.