Repository navigation
feat(plugins): add signed registry index client - #1726
Open
developerkunal wants to merge 1 commit into
Open
developerkunal wants to merge 1 commit into
developerkunal wants to merge 1 commit into
Conversation
![semgrepcode-auth0[bot]](https://avatars.githubusercontent.com/in/977730?s=60&v=4){kind=small}
Fetch the plugin registry index, refuse anything that is not correctly signed, fresh and newer than what this machine has seen, and keep a verified copy on disk. A normal build trusts no keys yet, so it fails closed until the production key is embedded. - Ed25519 signature over the raw index bytes, embedded keys looked up by key ID, rollback and expiry checks, a revocation and deprecation list, and a policy block with offline grace and check interval. - Index and per-plugin files are validated against an embedded schema, with duplicate keys, case variant keys and unsorted permission lists rejected, and each version's permissions hash recomputed with the manifest algorithm. - A client with Refresh, Load and EnsureFresh. Files are staged and renamed in a fail closed order under a cross process file lock, the cache is verified again on every load, and a verified cache is used when the network, a rollback or a busy lock prevents a refresh. - Registries list in the CLI config with the built in auth0 entry, https only fetches including every redirect hop, and size caps on every read. - registrytest fixtures and a plugintest build tag that trusts a throwaway key and allows loopback http, so the flow can be tested without publishing. Contract vectors are shipped for the catalog pipeline. - Shared helpers in the plugins package: strict JSON decoding that rejects duplicate keys, a normalized permissions function and a platform lookup.
developerkunal
force-pushed
the
DXCDT-2602/registry-client
branch
from
October 24, 2026 15:30
522d4e7 to
14e0f88
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🔧 Changes
Adds
internal/plugins/registry, a client that fetches the plugin registry index, refuses anything that is not correctly signed, fresh and newer than what this machine has already seen, and keeps a verified copy on disk. This is a library only, so nothing changes for users yet.Fail closed by default. A normal build embeds no trusted key yet, so every refresh fails until the production key is added under DXCDT-2611. Keys are embedded in the binary, and no environment variable, config entry or flag can add or replace one.
Verified before the index is used
permissionsHashis recomputed with the manifest algorithm.Client behavior
Loadverifies the cache every time and never uses the network.EnsureFreshfalls back to the verified cache and marks it stale without advancing the last refresh time. A registry that keeps failing therefore makes installed plugins unrunnable once the offline grace period (30 days by default) passes. A signature failure is never treated as offline.Config. The config gains an optional
registrieslist. The built inauth0registry is always there, a configuredauth0entry can only change its URL, and any other name is rejected because custom registries are not supported yet.Existing code.
ParseManifestandParseInstalledManifestnow reject duplicate JSON keys, which is a deliberate stricter behavior.📚 References
DXCDT-2602. This is part of the plugin framework stack of 11 PRs and builds on the PR below it, DXCDT-2601.
🔬 Testing
The new code is covered by unit tests.
📝 Checklist