Limedoc plugins — store catalog

Signed coordinates for plugin packs published to the Forgejo generic package registry org limedoc-plugins. This repo does not hold pack source trees or zip payloads.

Files

File	Purpose
catalog.json	Pack listings (kind, id, version, download/sha256/sig URLs)
catalog.json.sig.json	OpenBao signature over the canonical catalog hash (CI)
scripts/canonical_hash.ts	Offline hash helper (sorted-key JSON + trailing LF)

Raw URLs

https://git.belowtoxic.cloud/belowtoxic.eu/limedoc-plugins/raw/branch/main/catalog.json
https://git.belowtoxic.cloud/belowtoxic.eu/limedoc-plugins/raw/branch/main/catalog.json.sig.json

Limedoc today browses via PACKAGE_STORE_URL/v1/packs (store front-end). This catalog is the signed source of truth those fronts (or a future client fallback) should mirror.

Package bytes (Forgejo generic packages)

Piece	URL pattern
Zip	…/api/packages/limedoc-plugins/generic/{id}/{version}/{id}-{version}.zip
Content hash	…/{id}-{version}.sha256
Pack signature	…/{id}-{version}.sig.json

Pack source repos live under org limedoc-plugins/<id> and publish with Transit key publisher-limedoc-plugins-release (see publisher CI templates in the Limedoc monorepo).

OpenBao (this catalog repo)

Item	Value
JWT role	limedoc-registry-plugins
Bound repo	belowtoxic.eu/limedoc-plugins (refs/heads/main)
Transit key / keyId	limedoc-registry-plugins-2026

Limedoc verifies catalog signatures with storeCatalogKeys in the app’s baked release-trust.json (not the trust-root key used for publishers.json).

Add a pack row

1. Publish zip + sha256 + sig.json from the pack’s publisher CI.
2. Append/update an entry in catalog.json (downloadUrl, sha256Url, sigUrl).
3. Merge to main — CI resigns and commits catalog.json.sig.json.

CI secret

PACKAGE_TOKEN — Forgejo token with write access to this repo.

Local hash

deno run -A scripts/canonical_hash.ts catalog.json