Publish the official plugin catalogue, with the helloworld plugin, switchable from Server settings #729

New issue

Closed

opened 2026-10-07 18:19:20 +00:00 by tiagoagueda · 0 comments

tiagoagueda commented

2026-10-07 18:19:20 +00:00

Owner

Postulo has had everything a catalogue needs (signed index, Ed25519 key, per-wheel checksum, an Official row) and nothing in it: the official row pointed nowhere and OFFICIAL_KEYS was empty, so nothing could ever be official.

What this adds

catalogue/official/: plugins.toml (the source), index.json and index.json.sig (what an instance fetches), listing only postulo-helloworld 0.3.0 for now.
scripts/official_catalogue.py build | sign | verify: the index is built from the wheels, so the checksum is the file's and not a typed one; the signature is Ed25519 over the exact bytes; verify runs what an instance runs.
provenance.OFFICIAL_URL / OFFICIAL_KEY, and OFFICIAL_KEYS holding the key, so a file whose checksum the official index signed is labelled Official.
Migration 0009: the official row learns the address and key and stays switched off. An administrator turns it on and off with the existing Switch on / Switch off button in Server settings > Plugins; nothing is fetched until then.

Key custody. The private key is in the project's vaultwarden as a secure note and in no repository; sign refuses any other key.

Hosting. Raw URL of main in this repository; the helloworld wheel is a Forgejo release asset of postulo-helloworld v0.3.0.

Postulo has had everything a catalogue needs (signed index, Ed25519 key, per-wheel checksum, an *Official* row) and nothing in it: the official row pointed nowhere and `OFFICIAL_KEYS` was empty, so nothing could ever be official. **What this adds** - `catalogue/official/`: `plugins.toml` (the source), `index.json` and `index.json.sig` (what an instance fetches), listing only `postulo-helloworld` 0.3.0 for now. - `scripts/official_catalogue.py build | sign | verify`: the index is built from the wheels, so the checksum is the file's and not a typed one; the signature is Ed25519 over the exact bytes; `verify` runs what an instance runs. - `provenance.OFFICIAL_URL` / `OFFICIAL_KEY`, and `OFFICIAL_KEYS` holding the key, so a file whose checksum the official index signed is labelled Official. - Migration 0009: the official row learns the address and key and **stays switched off**. An administrator turns it on and off with the existing *Switch on / Switch off* button in Server settings > Plugins; nothing is fetched until then. **Key custody.** The private key is in the project's vaultwarden as a secure note and in no repository; `sign` refuses any other key. **Hosting.** Raw URL of `main` in this repository; the helloworld wheel is a Forgejo release asset of postulo-helloworld v0.3.0.

tiagoagueda added this to the 0.5.0 milestone

2026-10-07 18:19:20 +00:00

tiagoagueda referenced this issue from a commit

2026-10-07 18:37:15 +00:00

Publish the official plugin catalogue, with postulo-helloworld in it

tiagoagueda closed this issue

2026-10-07 18:37:15 +00:00

tiagoagueda referenced this issue from a commit

2026-10-10 08:08:28 +00:00

Bring the translation status file level after the removed plugins-page string

tiagoagueda referenced this issue from a commit

2026-10-12 09:51:34 +00:00