enricobuehlerandClaude Fable 5
efb37d1826
The catalog the Punktfunk plugin store fetches. Served straight out of this repository over Gitea's anonymous raw endpoint: https://git.unom.io/unom/punktfunk-plugin-index/raw/branch/main/v1/index.json https://git.unom.io/unom/punktfunk-plugin-index/raw/branch/main/v1/index.json.sig Hosts verify the ed25519 signature against a compiled-in public key and only then parse. Verified that the raw endpoint serves blobs byte-for-byte, which the signature depends on; .gitattributes pins LF so a Windows checkout cannot break it from the other direction. Entries pin one exact version plus that version's registry tarball integrity hash -- no ranges, no "latest". A plugin author publishing a new version changes nothing for users; the new version becomes installable only when a reviewer works the checklist and lands a new pinned entry here. That data shape is what makes "verified on every release" enforceable rather than a promise. Seeded with the two first-party plugins, both integrity hashes confirmed against the live registry: - @punktfunk/plugin-rom-manager 0.3.1 (linux, windows) - @punktfunk/plugin-playnite 0.1.1 (windows) Tooling (bun + TypeScript, node builtins only): - validate: every field rule the host enforces, plus a live registry cross-check that the pinned version exists and its dist.integrity matches the pin. Strict on unknown keys, since the host silently drops entries that fail validation -- a `min_host` typo would otherwise ship as a missing version floor with no error anywhere. - sign / verify / keygen: ed25519 over the exact bytes of index.json. keygen never prints the private key; verify defaults to the host-pinned public key so an index can be audited with no arguments. CI splits by trust: pull requests run validate only and hold no secrets, so a fork PR can never reach the signing key or a token that can write to main. Publishing from main validates, signs, self-verifies, then commits the signature back. The loop guard is a paths-ignore filter on v1/index.json.sig, with a [skip ci] marker as a second line of defence; ed25519 determinism means an unchanged index re-signs to identical bytes and commits nothing at all. CI signs after the merge, so there is a brief window where index.json is newer than its signature. It fails closed -- hosts reject the document and keep their last good cached catalog -- and is documented as such in the README. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
50 lines
1.7 KiB
JSON
50 lines
1.7 KiB
JSON
{
|
|
"schema": 1,
|
|
"name": "unom official",
|
|
"generated": "2026-07-20T18:00:00Z",
|
|
"plugins": [
|
|
{
|
|
"id": "rom-manager",
|
|
"pkg": "@punktfunk/plugin-rom-manager",
|
|
"registry": "https://git.unom.io/api/packages/unom/npm/",
|
|
"title": "ROM Manager",
|
|
"description": "Scans your ROM directories, maps them to emulators, fetches box art, and reconciles everything into the host game library as a provider. Includes a console-hosted web UI for mapping and cleanup.",
|
|
"icon": "gamepad-2",
|
|
"author": "unom",
|
|
"homepage": "https://git.unom.io/unom/punktfunk-plugin-rom-manager",
|
|
"license": "MIT OR Apache-2.0",
|
|
"version": "0.3.1",
|
|
"integrity": "sha512-SGqMriqQPOQobXMYiT20w0rcTMNdYfZc8No3fPu57njMN+2eTVBVlQjyn1t3KoRFxfoRYGwuumN4X3aNmS0Tpw==",
|
|
"verification": {
|
|
"reviewedAt": "2026-07-20"
|
|
},
|
|
"minHost": "0.15.0",
|
|
"platforms": [
|
|
"linux",
|
|
"windows"
|
|
]
|
|
},
|
|
{
|
|
"id": "playnite",
|
|
"pkg": "@punktfunk/plugin-playnite",
|
|
"registry": "https://git.unom.io/api/packages/unom/npm/",
|
|
"title": "Playnite",
|
|
"description": "Bridges your Playnite library on Windows into the host game library, keeping installed games, metadata, and launch commands in sync as a library provider.",
|
|
"icon": "library",
|
|
"author": "unom",
|
|
"homepage": "https://git.unom.io/unom/punktfunk-plugin-playnite",
|
|
"license": "MIT OR Apache-2.0",
|
|
"version": "0.1.1",
|
|
"integrity": "sha512-H40QEcUN7g0wHTy5CFCOTA4+j/FypbVzWSZ0OlW5Ej5+FnnT1fMUDVOx8KEH34mavTy70fd1zx3zDucu9hNQuQ==",
|
|
"verification": {
|
|
"reviewedAt": "2026-07-20"
|
|
},
|
|
"minHost": "0.15.0",
|
|
"platforms": [
|
|
"windows"
|
|
]
|
|
}
|
|
],
|
|
"security": []
|
|
}
|