skills.rest
kriscendobot
kriscendobotCOMMUNITY
Explore all skills by this author →
GitHub

verify-upstream-state-before-pinning

Verifies dependency checksums and metadata from live upstream project sources using curl and sha256 hashing utilities.

3|2|Updated May 12, 2026
Search Tags:#automation#security#verification#supply-chain#dependency#checksum
One-click install
npx skills add https://github.com/kriscendobot/garden --skill verify-upstream-state-before-pinning
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: verify-upstream-state-before-pinning
Source: https://github.com/kriscendobot/garden/tree/main/skills/verify-upstream-state-before-pinning
Command: npx skills add https://github.com/kriscendobot/garden --skill verify-upstream-state-before-pinning

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill prevents the use of stale, guessed, or inaccurate dependency versions and checksums by forcing a fresh, verified fetch from the upstream source.

Core Features & Use Cases

  • Live Verification: Fetches current release metadata directly from upstream sources like GitHub releases or project download indexes.
  • Integrity Assurance: Computes fresh sha256 checksums to prevent supply chain mismatches and cache poisoning.
  • Use Case: When a dependency-triage job suggests a new library version, use this Skill to confirm the release date, verify the checksum, and update the project configuration with validated, source-of-truth data.

Quick Start

Use the verify-upstream-state-before-pinning skill to validate the latest release of the target dependency and update the project metadata.

Frequently Asked Questions about verify-upstream-state-before-pinning

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I verify external dependency checksums against live upstream sources?▼

To verify external dependency checksums, you fetch live release metadata directly from upstream project sources and compute fresh sha256 hashes to prevent stale dependency injection and supply chain mismatches.

Why does dependency pinning fail when using cached or stale checksums?▼

Dependency pinning fails with stale checksums because cached metadata causes supply chain mismatches. Forcing a fresh, verified fetch from the upstream source prevents cache poisoning and confirms the release date.

Do I need curl to automate dependency integrity verification for security auditing?▼

Yes, you need curl and standard hashing utilities to automate dependency integrity verification. These tools fetch current release metadata from upstream sources and compute fresh sha256 checksums for security auditing.

What is the best way to prevent supply chain attacks during automated build configuration updates?▼

The best way to prevent supply chain attacks during automated build configuration updates is computing fresh sha256 checksums by fetching live data directly from upstream project sources to ensure metadata accuracy.

When do I need to fetch live release metadata for a dependency-triage job?▼

You need to fetch live release metadata for a dependency-triage job when a new library version is suggested. This confirms the release date, verifies the checksum, and updates the project configuration with validated data.

Related Skills

Explore More Software Engineering Skills→
coleam00coleam00
23.1k

test-release

Automate end-to-end validation of released Archon binaries across brew, curl-mac, and curl-vps install paths.

Community
Advanced
timequitytimequity
6

expo-workflows

Automates Expo app setup, builds, updates, and environment management workflows for mobile projects.

Official
Intermediate
wodehwodeh

cso

Audit infrastructure security with OWASP and STRIDE threat modeling.

Community
Advanced
githubnextgithubnext
4

supply-chain-security

Enforce security protocols for APM dependency resolution and package management.

Official
Advanced