Packaging & Distribution

Preview: manual sideload validation is the only designed community flow. There is no public marketplace, remote registry installer, automatic update channel or executable community-worker release.

Community bundle v1

A bundle directory contains plugin-bundle.json, a regular artifact file and a regular declarative descriptor file. The manifest declares:

{
  "schemaVersion": 1,
  "plugin": { "tier": "community" },
  "artifact": {
    "path": "dist/plugin.js",
    "sha256": "64 lowercase-or-uppercase hexadecimal characters"
  },
  "descriptor": {
    "path": "descriptor.json",
    "sha256": "64 lowercase-or-uppercase hexadecimal characters"
  },
  "signature": {
    "algorithm": "ed25519",
    "scope": "bundle",
    "publicKey": "optional PEM or base64 SPKI public key",
    "value": "optional base64 signature over the canonical bundle payload"
  }
}

Desktop Add-ons installs the local bundle directory, validates the Plugin API manifest, community permission allowlist, path containment, regular-file status, both SHA-256 values and, when declared, the Ed25519 signature. A path cannot escape the bundle directory or resolve through a symlink. Installation records the approved version and digests, restores an unchanged bundle on restart, and requires a new grant after a version or digest change. Verification reads and hashes the artifact; it never executes it.

scope: "bundle" signs the stable JSON payload containing schemaVersion, plugin, artifact and descriptor, excluding the signature field itself. It is mandatory for a signed bundle that declares a descriptor, so an attacker cannot replace permissions, contributions or descriptor integrity data while reusing a valid artifact signature. scope: "artifact" is supported only for legacy signed bundles without a descriptor.

Opt-in catalog preview

Desktop can display an optional Community Add-ons catalog, but it is disabled until the owner explicitly acknowledges that publishers are not verified by the Tape Music Hub team. Catalog browsing never downloads, installs, updates or executes a plugin. Installation remains a local-folder action that runs the verification process described above.

An operator can provide an HTTPS JSON index through MUSIC_HUB_COMMUNITY_ADDONS_REGISTRY_URL. Desktop reads a bounded catalog of at most 100 entries and displays repository links plus declared permissions. The index has this shape:

{
  "addons": [
    {
      "id": "publisher.my-plugin",
      "name": "My Plugin",
      "version": "1.2.3",
      "description": "One concise description.",
      "publisher": "Publisher name",
      "repository": "https://github.com/publisher/my-plugin",
      "permissions": ["storage.private"]
    }
  ]
}

Every catalog entry is informational. A user still obtains the bundle from a source they trust and imports the local directory for validation.

Independent releases

Keep a plugin in its own Git repository and version it independently. Publish the source URL, licence, release notes, compatible Desktop/API ranges and privacy statement with every release. Bump the plugin major version for a breaking public contract change and update the artifact digest for every build.

Local development packages are intentionally distinct from distributable bundles. They require developer mode, remain visibly untrusted, and do not replace signing or review. Publisher trust roots, remote registries and updates are future capabilities and will need a separate published contract.