Skip to content

Releases: kurokobo/dify-plugin-daemon

Release list

0.0.6+signature+p04

0.0.6+signature+p04 Latest
Latest

Choose a tag to compare

View all tags
@kurokobo kurokobo released this 02 Apr 14:11
0.0.6+signature+p04
ff830f0

✨ Changelog

  • Use app.Config to avoid reading environment variables directly

✨ New sub commands for CLI

Ready-to-Use binaries: https://github.com/kurokobo/dify-plugin-daemon/releases/tag/0.0.6%2Bsignature%2Bp04

# generate new key pair with specified name; 
dify-plugin signature generate -f myorg

# sign existing difypkg with specified private key
dify-plugin signature sign ./mypkg.difypkg -p myorg.private.pem

# verify existing difypkg with both official public key and specified public key (for testing purpose)
dify-plugin signature verify ./mypkg.difypkg -p myorg.public.pem

✨ New environment variables for daemon

Ready-to-Use container images: https://github.com/kurokobo/dify-plugin-daemon/pkgs/container/dify-plugin-daemon

# Enable or disable third-party signature verification for plugins
# Set to "true" to allow verification using additional public keys specified in THIRD_PARTY_SIGNATURE_VERIFICATION_PUBLIC_KEYS
THIRD_PARTY_SIGNATURE_VERIFICATION_ENABLED=false

# A comma-separated list of file paths to public keys in addition to the official public key for signature verification
THIRD_PARTY_SIGNATURE_VERIFICATION_PUBLIC_KEYS=

✨ Example Configuration Steps

For Self-Hosted Dify 1.0+ only. Not applicable for Cloud edition.

  1. Download executable dify-plugin binary from the release page of forked demo project
  2. Prepare your own difypkg file by dify-plugin plugin package command
  3. Generate new key pair for signing and verification 
    dify-plugin signature generate -f myorg
    • This step will generate myorg.private.pem and myorg.public.pem
  4. Sign your difypkg with myorg.private.pem 
    dify-plugin signature sign my-custom-plugin.difypkg -p myorg.private.pem
    • This step will generate my-custom-plugin.signed.difypkg
  5. You can verify signature of difypkg by verify command 
    dify-plugin signature verify my-custom-plugin.signed.difypkg -p myorg.public.pem
  6. Create new directory public_keys under your docker/volumes/plugin_daemon
  7. Place your myorg.public.pem (Public Key) under docker/volumes/plugin_daemon/public_keys
  8. Place docker-compose.override.yaml file with following content, on the next to your docker-compose.yaml 
    services:
  plugin_daemon:
    image: ghcr.io/kurokobo/dify-plugin-daemon:0.0.6-signature-p04-local
    environment:
      FORCE_VERIFYING_SIGNATURE: true
      THIRD_PARTY_SIGNATURE_VERIFICATION_ENABLED: true
      THIRD_PARTY_SIGNATURE_VERIFICATION_PUBLIC_KEYS: /app/storage/public_keys/myorg.public.pem
  9. Start your Dify and try installing my-custom-plugin.signed.difypkg.

✨ Related Links

Assets 5
Loading

0.0.6+signature+p03

0.0.6+signature+p03

Choose a tag to compare

View all tags
@kurokobo kurokobo released this 30 Mar 16:36
0.0.6+signature+p03
4b2dde0 
fix: remove command to create dummy file
Loading

0.0.6+signature+p02

0.0.6+signature+p02

Choose a tag to compare

View all tags
@kurokobo kurokobo released this 24 Mar 14:56
0.0.6+signature+p02
b91cb50

✨ Changelog

  • 308d3cd: fix: rename environment variable

✨ New sub commands for CLI

Ready-to-Use binaries: https://github.com/kurokobo/dify-plugin-daemon/releases/tag/0.0.6%2Bsignature%2Bp02

# generate new key pair with specified name; 
dify-plugin signature generate -f myorg

# sign existing difypkg with specified private key
dify-plugin signature sign ./mypkg.difypkg -p myorg.private.pem

# verify existing difypkg with both official public key and specified public key (for testing purpose)
dify-plugin signature verify ./mypkg.difypkg -p myorg.public.pem

✨ New environment variables for daemon

Ready-to-Use container images: https://github.com/kurokobo/dify-plugin-daemon/pkgs/container/dify-plugin-daemon

# Enable or disable third-party signature verification for plugins
# Set to "true" to allow verification using additional public keys specified in THIRD_PARTY_SIGNATURE_VERIFICATION_PUBLIC_KEYS
THIRD_PARTY_SIGNATURE_VERIFICATION_ENABLED=false

# A comma-separated list of file paths to public keys in addition to the official public key for signature verification
THIRD_PARTY_SIGNATURE_VERIFICATION_PUBLIC_KEYS=

✨ Example Configuration Steps

For Self-Hosted Dify 1.0+ only. Not applicable for Cloud edition.

  1. Download executable dify-plugin binary from the release page of forked demo project
  2. Prepare your own difypkg file by dify-plugin plugin package command
  3. Generate new key pair for signing and verification 
    dify-plugin signature generate -f myorg
    • This step will generate myorg.private.pem and myorg.public.pem
  4. Sign your difypkg with myorg.private.pem 
    dify-plugin signature sign my-custom-plugin.difypkg -p myorg.private.pem
    • This step will generate my-custom-plugin.signed.difypkg
  5. You can verify signature of difypkg by verify command 
    dify-plugin signature verify my-custom-plugin.signed.difypkg -p myorg.public.pem
  6. Create new directory public_keys under your docker/volumes/plugin_daemon
  7. Place your myorg.public.pem (Public Key) under docker/volumes/plugin_daemon/public_keys
  8. Place docker-compose.override.yaml file with following content, on the next to your docker-compose.yaml 
    services:
  plugin_daemon:
    image: ghcr.io/kurokobo/dify-plugin-daemon:0.0.6-signature-p02-local
    environment:
      FORCE_VERIFYING_SIGNATURE: true
      THIRD_PARTY_SIGNATURE_VERIFICATION_ENABLED: true
      THIRD_PARTY_SIGNATURE_VERIFICATION_PUBLIC_KEYS: /app/storage/public_keys/myorg.public.pem
  9. Start your Dify and try installing my-custom-plugin.signed.difypkg.

✨ Related Links

Loading

0.0.6+signature+p01

0.0.6+signature+p01

Choose a tag to compare

View all tags
@kurokobo kurokobo released this 23 Mar 16:25
0.0.6+signature+p01
5c44c44

✨ Changelog

  • 5ca7ee3: fix: move SignPluginWithPrivateKey to a sub-package to reduce the likelihood of references to embedded private keys

✨ New sub commands for CLI

Ready-to-Use binaries: https://github.com/kurokobo/dify-plugin-daemon/releases/tag/0.0.6%2Bsignature%2Bp01

# generate new key pair with specified name; 
dify-plugin signature generate -f myorg

# sign existing difypkg with specified private key
dify-plugin signature sign ./mypkg.difypkg -p myorg.private.pem

# verify existing difypkg with both official public key and specified public key (for testing purpose)
dify-plugin signature verify ./mypkg.difypkg -p myorg.public.pem

✨ New environment variables for daemon

Ready-to-Use container images: https://github.com/kurokobo/dify-plugin-daemon/pkgs/container/dify-plugin-daemon

# Enable or disable third-party signature verification for plugins
# Set to "true" to allow verification using additional public keys specified in THIRD_PARTY_SIGNATURE_VERIFICATION_PUBLIC_KEYS
ENABLE_THIRD_PARTY_SIGNATURE_VERIFICATION=false

# A comma-separated list of file paths to public keys in addition to the official public key for signature verification
THIRD_PARTY_SIGNATURE_VERIFICATION_PUBLIC_KEYS=

✨ Example Configuration Steps

For Self-Hosted Dify 1.0+ only. Not applicable for Cloud edition.

  1. Download executable dify-plugin binary from the release page of forked demo project
  2. Prepare your own difypkg file by dify-plugin plugin package command
  3. Generate new key pair for signing and verification 
    dify-plugin signature generate -f myorg
    • This step will generate myorg.private.pem and myorg.public.pem
  4. Sign your difypkg with myorg.private.pem 
    dify-plugin signature sign my-custom-plugin.difypkg -p myorg.private.pem
    • This step will generate my-custom-plugin.signed.difypkg
  5. You can verify signature of difypkg by verify command 
    dify-plugin signature verify my-custom-plugin.signed.difypkg -p myorg.public.pem
  6. Create new directory public_keys under your docker/volumes/plugin_daemon
  7. Place your myorg.public.pem (Public Key) under docker/volumes/plugin_daemon/public_keys
  8. Place docker-compose.override.yaml file with following content, on the next to your docker-compose.yaml 
    services:
  plugin_daemon:
    image: ghcr.io/kurokobo/dify-plugin-daemon:0.0.6-signature-p01-local
    environment:
      FORCE_VERIFYING_SIGNATURE: true
      ENABLE_THIRD_PARTY_SIGNATURE_VERIFICATION: true
      THIRD_PARTY_SIGNATURE_VERIFICATION_PUBLIC_KEYS: /app/storage/public_keys/myorg.public.pem
  9. Start your Dify and try installing my-custom-plugin.signed.difypkg.

✨ Related Links

Loading

POC: 0.0.6+signature

POC: 0.0.6+signature

Choose a tag to compare

View all tags
@kurokobo kurokobo released this 23 Mar 07:10
0.0.6+signature
714bb7d

✨ New sub commands for CLI

Ready-to-Use binaries: https://github.com/kurokobo/dify-plugin-daemon/releases/tag/0.0.6%2Bsignature

# generate new key pair with specified name; 
dify-plugin signature generate -f myorg

# sign existing difypkg with specified private key
dify-plugin signature sign ./mypkg.difypkg -p myorg.private.pem

# verify existing difypkg with both official public key and specified public key (for testing purpose)
dify-plugin signature verify ./mypkg.difypkg -p myorg.public.pem

✨ New environment variables for daemon

Ready-to-Use container images: https://github.com/kurokobo/dify-plugin-daemon/pkgs/container/dify-plugin-daemon

# Enable or disable third-party signature verification for plugins
# Set to "true" to allow verification using additional public keys specified in THIRD_PARTY_SIGNATURE_VERIFICATION_PUBLIC_KEYS
ENABLE_THIRD_PARTY_SIGNATURE_VERIFICATION=false

# A comma-separated list of file paths to public keys in addition to the official public key for signature verification
THIRD_PARTY_SIGNATURE_VERIFICATION_PUBLIC_KEYS=

✨ Example Configuration Steps

For Self-Hosted Dify 1.0+ only. Not applicable for Cloud edition.

  1. Download executable dify-plugin binary from the release page of forked demo project
  2. Prepare your own difypkg file by dify-plugin plugin package command
  3. Generate new key pair for signing and verification 
    dify-plugin signature generate -f myorg
    • This step will generate myorg.private.pem and myorg.public.pem
  4. Sign your difypkg with myorg.private.pem 
    dify-plugin signature sign my-custom-plugin.difypkg -p myorg.private.pem
    • This step will generate my-custom-plugin.signed.difypkg
  5. You can verify signature of difypkg by verify command 
    dify-plugin signature verify my-custom-plugin.signed.difypkg -p myorg.public.pem
  6. Create new directory public_keys under your docker/volumes/plugin_daemon
  7. Place your myorg.public.pem (Public Key) under docker/volumes/plugin_daemon/public_keys
  8. Place docker-compose.override.yaml file with following content, on the next to your docker-compose.yaml 
    services:
  plugin_daemon:
    image: ghcr.io/kurokobo/dify-plugin-daemon:0.0.6-signature-local
    environment:
      FORCE_VERIFYING_SIGNATURE: true
      ENABLE_THIRD_PARTY_SIGNATURE_VERIFICATION: true
      THIRD_PARTY_SIGNATURE_VERIFICATION_PUBLIC_KEYS: /app/storage/public_keys/myorg.public.pem
  9. Start your Dify and try installing my-custom-plugin.signed.difypkg.
Loading