Dicklesworthstone/destructive_command_guard v0.7.5

dcg v0.7.5 — authenticated local DSR release

on GitHub

Authenticated Windows release

This release was built natively on Windows from commit 36856463a6e4745b00c1a64e36ef7955fd7e4145 using DSR because the GitHub Actions release jobs were unavailable.

• Windows x86_64 installer ZIP SHA256: 56146822a94e45410cc15cfba4d55a409ba7284ed0b048ff2e8bc8c613f50d57
• Embedded dcg.exe SHA256: 40b33a37d51d212f11fcd47e1f6cb184b88232487f1ef6b463b8ae9da7029b14
• Minisign key ID: 69B3955C8D2E62A8
• Cosign public-key DER SHA256: 0e6947743daf39d6413cb25f6c96601427e38885f3a756e9f98f37d66e6df7a4
• Signed SLSA v1 provenance and the DSR native build manifest are included.

The v0.7.5 installers understand both this pinned local-release cosign key and the existing GitHub Actions OIDC identity. They also reject cosign versions affected by CVE-2026-22703.

Verify the Windows archive

minisign -Vm dcg-x86_64-pc-windows-msvc.zip -x dcg-x86_64-pc-windows-msvc.zip.minisig -P RWSoYi6NXJWzaRs1mJmOwwXrZfPWcq6MXnQlNMLBYKzlIQTLwuVQG6uO
cosign verify-blob --key dcg-cosign-release.pub --bundle dcg-x86_64-pc-windows-msvc.zip.sigstore.json dcg-x86_64-pc-windows-msvc.zip

The exact published ZIP was installed and self-tested successfully on a native Windows Surface Book with mandatory SHA256 and minisign verification plus cosign verification enabled.