SECURITY & TRUST
Trust is a process.
A useful plugin platform needs more than a signature. Here is the current desktop boundary and the publication model being designed for the web platform.
What the desktop verifies
Pack bundles are ZIP-based .cbpack files with a v2 manifest, a DER-encoded ECDSA P-256 / SHA-256 signature and a payload file inventory. The installer checks bounded archive metadata, manifest compatibility and per-file SHA-256 hashes before activation.
The strict signed catalog controls executable pack metadata. PR #522 adds a separately signed editorial marketplace directory. Listing text and ratings cannot grant permissions or bypass installation consent.
Production trust keys are currently empty and the owner pack channel is not configured. Those defaults reject production installations. They must be deliberately configured and verified before release.
Keep the signer outside the web app
A public request or a database status change must never be enough to bless arbitrary code. The existing metadata builder executes pack factories, so it is unsuitable for untrusted inputs in a process holding the production key.
- Authenticated developers submit to private quarantine storage. The web app has no signing permission or write access to the published channel.
- Isolated workers build and inspect a pinned source revision, without signing secrets or production credentials.
- A maintainer approves an immutable digest and review evidence through a protected process independent of the web database.
- The protected publisher verifies the source, provenance and exact artifact hashes, then signs approved bytes through a restricted key service or offline signer.
- Publish immutable artifacts and signed snapshots, with an atomic channel update and an auditable rollback procedure.
Understand the isolation limit
The desktop worker uses a separate process and a Windows Job Object for lifetime and resource control. This is not a filesystem or network permission sandbox. Signed code can still be dangerous.
Initial community distribution must therefore remain curated, reviewed and rebuilt. General unreviewed plugins require independently reviewed execution isolation, capability enforcement and a revocation design before they can be offered.
The first web milestone
This website provides product information, an illustrative local demo, documentation and links to approved desktop downloads. Accounts, marketplace, uploads and plugin delivery are not included in this release.
The website does not process your selected files or demo searches. Browser security headers restrict scripts and resources.