feat(plugin): enforce certified archive admission (#2553)

* feat(plugin): add certified admission policy

* feat(plugin): enforce certified archive admission

* chore(plugin): pin certified SDK beta

* fix(plugin): consume SDK beta 5

* style(plugin): format certification admission
This commit is contained in:
RockChinQ
2026-09-20 18:54:45 +08:00
committed by GitHub
parent 8f8356fe97
commit 20a04a77bf
14 changed files with 871 additions and 71 deletions
+6
View File
@@ -261,6 +261,12 @@ plugin:
runtime_ws_url: 'ws://langbot_plugin_runtime:5400/control/ws'
enable_marketplace: true
display_plugin_debug_url: 'ws://localhost:5401/plugin/debug/ws'
certification:
# Non-secret Ed25519 issuer key ring used to verify the SDK ZIP-comment
# certification envelope. Values are standard base64-encoded raw public
# keys; add keys during issuer rotation and remove retired IDs only after
# every affected archive has been upgraded.
trusted_public_keys: {}
worker:
# Instance-wide maximum for every plugin installation. Plugin
# manifests cannot raise or override these limits.