Skip to main content
Digital signing helps users be certain that a plugin package comes from you and has not been tampered with. Nagare uses detached Ed25519 signatures, stored in a file named <package_name>.nagare_plugin.sig.

​
For plugin authors

1

Generate a key pair

Keep plugin-signing-key.pem secret. Share plugin-signing-key.pub.pem with users.
2

Build and sign

This generates both <package_name>.nagare_plugin and <package_name>.nagare_plugin.sig. If you rebuild without --sign, the old .sig file is deleted to avoid stale signatures.
3

Distribute

Release both the .nagare_plugin and .sig files.

​
For users

​
Trust the author’s key

Copy the author’s public key into the ~/.nagare/trusted directory:
Keys can be in PEM (PKIX) format or a raw base64/hex string. You can place multiple keys in this directory.

​
Install a signed package

  • Web UI: upload the .nagare_plugin file and (optionally) the .sig file.
  • If you do not upload a .sig, Nagare looks for a .sig file next to the plugin package.

​
Installation warnings

If the signature is invalid (does not match any trusted key), installation is rejected.
Plugins run with the privileges of the current user. Only install plugins from sources you trust.