Hostpanel.Sdk.Packaging
3.2.0
dotnet add package Hostpanel.Sdk.Packaging --version 3.2.0
NuGet\Install-Package Hostpanel.Sdk.Packaging -Version 3.2.0
<PackageReference Include="Hostpanel.Sdk.Packaging" Version="3.2.0" />
<PackageVersion Include="Hostpanel.Sdk.Packaging" Version="3.2.0" />
<PackageReference Include="Hostpanel.Sdk.Packaging" />
paket add Hostpanel.Sdk.Packaging --version 3.2.0
#r "nuget: Hostpanel.Sdk.Packaging, 3.2.0"
#:package Hostpanel.Sdk.Packaging@3.2.0
#addin nuget:?package=Hostpanel.Sdk.Packaging&version=3.2.0
#tool nuget:?package=Hostpanel.Sdk.Packaging&version=3.2.0
Hostpanel.Sdk.Packaging
The checks a plugin package must pass, in one MIT licensed package, so the host that installs a package and the author who publishes it run the same code.
Hostpanel.Sdk.Packaging.Signing:PluginSignatureFile,PluginSignaturePayload(the exact v1 payload),PluginSigner(key generation and signing),PluginSignatureValidator(verification) andTrustedKeyId.Hostpanel.Sdk.Packaging.Naming:PluginIdentifier,PluginPageIdentifier,PluginVersionandPluginAssemblyNames(the assembly names a package may not carry).Hostpanel.Sdk.Packaging.Archive:PluginArchiveGuard(entry count, uncompressed size, path traversal).Hostpanel.Sdk.Packaging.Icons:PluginIconChecker.Hostpanel.Sdk.Packaging.Manifest:PluginManifestChecker(the rules that need no host state).
Every refusal is an enum value (Hostpanel.Sdk.Packaging.Enums) with a detail text that names a package-relative
path or a member of the manifest, never an absolute path of the machine it ran on.
Signing in a release pipeline
var (privateKey, publicKey) = PluginSigner.GenerateKeyPair();
PluginSigner.Sign(packageDirectory, "my-key-id", privateKey);
Sign the folder that will be zipped, after its last change: any later change to any file makes the signature invalid.
The payload header is a wire identifier
The first line of the signed payload, PluginSignaturePayload.Header (innovayse-plugin-signature-v1), is a fixed
identifier of the signature format, not a product name to be renamed or localised. Every signature ever made covers
these exact bytes, so changing the string would invalidate all of them. A new payload format gets a new header
(for example -v2 at the end) and a new reader; the v1 text stays as it is.
| Product | Versions Compatible and additional computed target framework versions. |
|---|---|
| .NET | net9.0 is compatible. net9.0-android was computed. net9.0-browser was computed. net9.0-ios was computed. net9.0-maccatalyst was computed. net9.0-macos was computed. net9.0-tvos was computed. net9.0-windows was computed. net10.0 was computed. net10.0-android was computed. net10.0-browser was computed. net10.0-ios was computed. net10.0-maccatalyst was computed. net10.0-macos was computed. net10.0-tvos was computed. net10.0-windows was computed. |
-
net9.0
- BouncyCastle.Cryptography (>= 2.7.0)
- Hostpanel.Sdk (>= 3.2.0)
NuGet packages
This package is not used by any NuGet packages.
GitHub repositories
This package is not used by any popular GitHub repositories.