hull marketplace verify

Synopsis

hull marketplace verify checks a plugin archive you downloaded against a marketplace index: it confirms the archive’s SHA-256 digest matches the one in the index and that the index’s signature for that plugin was made by a key you trust. It succeeds only when both checks pass.

When to use it

Run it before installing a plugin you downloaded out of band, so you know the archive hasn’t been altered and comes from a signer you pinned. Verify passing is your cue to run hull plugin install.

What happens

  1. hull fetches the marketplace index from --index (default https://plugins.hull.dev/index.json).
  2. hull reads the archive at --archive and computes its SHA-256, then compares it to the digest the index records for --name. A mismatch fails.
  3. hull loads your pinned trusted keys from ~/.config/hull/marketplace_trusted_keys.json (override with the HULL_TRUSTED_KEYS environment variable). The index’s own key list is never used, so a hostile index can’t supply its own root of trust.
  4. hull checks the index’s Ed25519 signature for --name against the pinned key that matches the plugin’s signer. A missing signature, an unknown signer, or a bad signature fails.
  5. On success hull prints <name>: signature OK and exits 0. On any failure it prints the reason and exits non-zero.

Usage 

hull marketplace verify [flags]

Flags

Flag Cause → effect
--archive <path> Verify this archive file. Required.
--name <name> Match against this plugin’s entry in the index. Required; must match an index entry.
--index <url> Fetch the index from this URL instead of the default https://plugins.hull.dev/index.json.

Also inherits the global flags.

Worked example

Verify a downloaded archive, then install it once it passes:

hull marketplace verify --archive ./backup-restore.tar.gz --name backup-restore

backup-restore: signature OK

hull plugin install ./backup-restore

Verify against a private marketplace:

hull marketplace verify \
  --archive ./internal-tool.tar.gz \
  --name internal-tool \
  --index https://plugins.example.internal/index.json

See also