> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nagare.smtdfc.net/llms.txt
> Use this file to discover all available pages before exploring further.

# Plugin Signing

> Sign plugin packages with an Ed25519 key and configure trusted keys so Nagare can verify plugins at install time.

Digital signing helps users be certain that a plugin package comes from you and has not been tampered with. Nagare uses detached **Ed25519** signatures, stored in a file named `<package_name>.nagare_plugin.sig`.

## For plugin authors

**1. Generate a key pair**

```bash theme={null}
openssl genpkey -algorithm ED25519 -out plugin-signing-key.pem
openssl pkey -in plugin-signing-key.pem -pubout -out plugin-signing-key.pub.pem
```

Keep `plugin-signing-key.pem` secret. Share `plugin-signing-key.pub.pem` with users.

**2. Build and sign**

```bash theme={null}
nagare plugin build --sign plugin-signing-key.pem
```

This generates both `<package_name>.nagare_plugin` and `<package_name>.nagare_plugin.sig`. If you rebuild without `--sign`, the old `.sig` file is deleted to avoid stale signatures.

**3. Distribute**

Release both the `.nagare_plugin` and `.sig` files.

## For users

### Trust the author's key

Copy the author's public key into the `~/.nagare/trusted` directory:

```bash theme={null}
mkdir -p ~/.nagare/trusted
cp plugin-signing-key.pub.pem ~/.nagare/trusted/publisher.pem
```

Keys can be in PEM (PKIX) format or a raw base64/hex string. You can place multiple keys in this directory.

### Install a signed package

* Web UI: upload the `.nagare_plugin` file and (optionally) the `.sig` file.
* If you do not upload a `.sig`, Nagare looks for a `.sig` file next to the plugin package.

### Installation warnings

| Status | Meaning |
| - | - |
| `verified` | Signature is valid with a key in `~/.nagare/trusted`. |
| `unverified` | The package has a signature but no trusted key is available to verify it. The plugin is still installed, with a warning. |
| `unsigned` | The package has no signature. The plugin is still installed, with a warning. |

If the signature is **invalid** (does not match any trusted key), installation is rejected.

> [!WARNING]
>
> Plugins run with the privileges of the current user. Only install plugins from sources you trust.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.