dsh-pack v0.4.2 — Distribution Governance

WHY-Daydream released this 30 Aug 05:24

· 92 commits to main since this release

e48c39f

Highlights

Real GHCR OCI distribution verified 8/8（run 33292227705，2026-08-30）
image lock: mutable remote tag → immutable OCI manifest digest（D46–D49）
trust.yaml: repository-scoped execution policy（D50–D56）
local image prune: mark-and-sweep reachability CAS GC（D57–D63）

Release invariants

Lock ≠ Trust
Cache ≠ Trust
Registry ≠ Trust Authority
OCI digest ≠ DSH contentHash
CLI may tighten policy, never weaken it

Pipeline

Snapshot → Portable → Trusted → Runnable → Distributed → Governed

Assets 2