punktfunk-plugin-index

5 Commits

Author	SHA1	Message	Date
unom-bot	5b293d5b34	chore(index): sign v1/index.json [skip ci] Signature over `05e772fedd`. Generated by the publish workflow; do not edit by hand.	2026-07-20 21:24:34 +00:00
enricobuehlerandClaude Fable 5	05e772fedd	chore(index): repin to the signing key held in this repo's secret publish / publish (push) Successful in 26s Details The previous key was pasted into unom/punktfunk's secret store rather than this one. Gitea secrets don't cross repos and can't be read back, so that key was unusable here and is abandoned; INDEX_SIGNING_KEY on THIS repo now holds the private half of the key pinned below. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 23:05:39 +02:00
enricobuehlerandClaude Fable 5	575ea1a371	chore(index): repin to the operator-held signing key publish / publish (push) Failing after 18s Details The bootstrap key generated during implementation was lost with its scratch directory. Nothing shipped pinning it, so this is a straight replacement of slot 0 rather than a rotation — the second slot stays reserved for a real one. The private half now lives only in the INDEX_SIGNING_KEY secret, so CI is the only thing that can sign. This push is what makes it do so: the committed signature is still the old key's, and the verify self-check will fail loudly if the secret does not match the public key pinned here. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 22:57:38 +02:00
enricobuehlerandClaude Fable 5	ce8b13c52b	chore(index): bootstrap signature for the seed catalog Signed locally with the key whose public half the host pins. ed25519 is deterministic, so the publish workflow re-signing this exact document with the same key produces byte-identical output — this is the bootstrap for a repo whose CI secret is not yet configured, not a parallel signing path. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 20:28:08 +02:00
enricobuehlerandClaude Fable 5	efb37d1826	feat: signed plugin index with validation and publish pipeline The catalog the Punktfunk plugin store fetches. Served straight out of this repository over Gitea's anonymous raw endpoint: https://git.unom.io/unom/punktfunk-plugin-index/raw/branch/main/v1/index.json https://git.unom.io/unom/punktfunk-plugin-index/raw/branch/main/v1/index.json.sig Hosts verify the ed25519 signature against a compiled-in public key and only then parse. Verified that the raw endpoint serves blobs byte-for-byte, which the signature depends on; .gitattributes pins LF so a Windows checkout cannot break it from the other direction. Entries pin one exact version plus that version's registry tarball integrity hash -- no ranges, no "latest". A plugin author publishing a new version changes nothing for users; the new version becomes installable only when a reviewer works the checklist and lands a new pinned entry here. That data shape is what makes "verified on every release" enforceable rather than a promise. Seeded with the two first-party plugins, both integrity hashes confirmed against the live registry: - @punktfunk/plugin-rom-manager 0.3.1 (linux, windows) - @punktfunk/plugin-playnite 0.1.1 (windows) Tooling (bun + TypeScript, node builtins only): - validate: every field rule the host enforces, plus a live registry cross-check that the pinned version exists and its dist.integrity matches the pin. Strict on unknown keys, since the host silently drops entries that fail validation -- a `min_host` typo would otherwise ship as a missing version floor with no error anywhere. - sign / verify / keygen: ed25519 over the exact bytes of index.json. keygen never prints the private key; verify defaults to the host-pinned public key so an index can be audited with no arguments. CI splits by trust: pull requests run validate only and hold no secrets, so a fork PR can never reach the signing key or a token that can write to main. Publishing from main validates, signs, self-verifies, then commits the signature back. The loop guard is a paths-ignore filter on v1/index.json.sig, with a [skip ci] marker as a second line of defence; ed25519 determinism means an unchanged index re-signs to identical bytes and commits nothing at all. CI signs after the merge, so there is a brief window where index.json is newer than its signature. It fails closed -- hosts reject the document and keep their last good cached catalog -- and is documented as such in the README. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 20:25:16 +02:00