k1nq/TREK
1
0
Fork 0
mirror of https://github.com/mauriceboe/TREK.git synced 2026-10-18 21:16:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(sdk): allow new signing key (#2088)

Browse Source
This commit is contained in:
jubnl
2026-08-28 00:56:44 +02:00
committed by GitHub
parent 922f37ab52
commit d8fd2deb12
22 changed files with 915 additions and 71 deletions
Download Patch File Download Diff File Expand all files Collapse all files
wiki/Plugins.md
+5 -1
View File
@@ -306,4 +306,8 @@ are refused (they'd collide with admin API routes) — and an `id` stays bound t
the GitHub owner who first registered it, so
nobody can repoint an existing plugin. Entries may optionally carry an author
signing key (`authorPublicKey` + a per-version `signature`) for offline signature
verification on top of the SHA-256 pin.
verification on top of the SHA-256 pin. A signed plugin's key changes only through
a maintainer-approved rotation; an instance that already has the plugin then shows
`SIGNATURE_KEY_CHANGED` — with both key fingerprints, so you can check the new one
with the author out of band — and pauses that plugin's updates until you re-trust
the new key.