Skip to content
Yttri Docs

Publishing to the catalog

The catalog is a shelf of reviewed plugins. Nothing lands there automatically: every version goes through manual attestation.

A version’s path

Section titled “A version’s path”
author's submission → attestation → signed with the Yttri key → catalog
  1. Submission. The author sends version metadata: the manifest, a link to the package and its SHA-256 checksum. The submission enters the “pending review” state and is not shown in the catalog.
  2. Attestation. The catalog owner is notified and reviews it by hand: what the plugin is, which rights it asks for, what the code does.
  3. Decision. A rejection returns a reason to the author. An approval publishes the version.
  4. Catalog. Only approved versions are visible to users.

Yttri signs, not the author

Section titled “Yttri signs, not the author”

What is signed is what passed attestation — so the signature appears at approval, not at submission. The signing key is never handed to authors.

In practice:

  • a package from the catalog is always signed, and Yttri verifies the signature at install time;
  • the signature states “this build was reviewed”, it is not a property of the file itself;
  • approving a version without a signature is technically impossible;
  • a compromised version can be revoked and disappears from the listing at once.

The signature sits next to the package as a separate file rather than inside it: it is computed over the package bytes, and embedding it would change those very bytes.

What is checked at submission

Section titled “What is checked at submission”

Formal things, for now: non-empty id and version, a well-formed SHA-256, an HTTPS link. Manifest validation and code review happen during human attestation.