pluginsign

Overview ¶

Command pluginsign re-signs a plugin manifest.json with a publisher's ed25519 seed, reusing the server's own plugin.SigningPayload so the signed bytes match the verifier byte-for-byte (including the design-10 ui/interfaces extension).

It reads the manifest, optionally recomputes digest_sha256 from the artifact (and fails if it disagrees with the on-disk digest unless -update-digest), signs the canonical payload, self-verifies, and writes the manifest back canonically so the on-disk ui/interfaces are exactly what was signed.

go run ./cmd/pluginsign -manifest path/manifest.json -seed seed.bin \
    -artifact path/system-go/binary [-update-digest] [-write]