Plugin trust store

Generated from schemas/plugin-trust-store.schema.json by scripts/gen-config-docs. Do not edit this page: edit the schema or the generator.

The local allow-list referenced by usage.trustStore. It is provisioned out-of-band and never fetched from a plugin.

Fields

Field Type Required Description

Field	Type	Required	Description
`keys`	map of string to string	yes	Signing keys: key id → raw Ed25519 public key, base64 (standard or raw URL encoding).
`allowedNames`	array of string	no	Allowed plugin names. Exact names or glob patterns interpreted with path.Match (for example com.cladone.*).
`allowedDependencies`	map of string to string	no	Allowed dependency digests: name → sha256 digest.
`revokedDigests`	array of string	no	Artefact digests refused even with a valid signature.
`allowAuth`	boolean	no	Allow manifests with kind=auth (high-trust modules). Default false.
`coreVersion`	string	no	Host API version, for example 1.5.0. Compared with the manifest hostAPI constraint.

keys

map of string to string

yes

Signing keys: key id → raw Ed25519 public key, base64 (standard or raw URL encoding).

allowedNames

array of string

Allowed plugin names. Exact names or glob patterns interpreted with path.Match (for example com.cladone.*).

allowedDependencies

map of string to string

Allowed dependency digests: name → sha256 digest.

revokedDigests

array of string

Artefact digests refused even with a valid signature.

allowAuth

boolean

Allow manifests with kind=auth (high-trust modules). Default false.

coreVersion

string

Host API version, for example 1.5.0. Compared with the manifest hostAPI constraint.