Skip to content

0.0.6+signature+p02

Choose a tag to compare

View all tags
@kurokobo kurokobo released this 24 Mar 14:56
0.0.6+signature+p02
b91cb50

✨ Changelog

  • 308d3cd: fix: rename environment variable

✨ New sub commands for CLI

Ready-to-Use binaries: https://github.com/kurokobo/dify-plugin-daemon/releases/tag/0.0.6%2Bsignature%2Bp02

# generate new key pair with specified name; 
dify-plugin signature generate -f myorg

# sign existing difypkg with specified private key
dify-plugin signature sign ./mypkg.difypkg -p myorg.private.pem

# verify existing difypkg with both official public key and specified public key (for testing purpose)
dify-plugin signature verify ./mypkg.difypkg -p myorg.public.pem

✨ New environment variables for daemon

Ready-to-Use container images: https://github.com/kurokobo/dify-plugin-daemon/pkgs/container/dify-plugin-daemon

# Enable or disable third-party signature verification for plugins
# Set to "true" to allow verification using additional public keys specified in THIRD_PARTY_SIGNATURE_VERIFICATION_PUBLIC_KEYS
THIRD_PARTY_SIGNATURE_VERIFICATION_ENABLED=false

# A comma-separated list of file paths to public keys in addition to the official public key for signature verification
THIRD_PARTY_SIGNATURE_VERIFICATION_PUBLIC_KEYS=

✨ Example Configuration Steps

For Self-Hosted Dify 1.0+ only. Not applicable for Cloud edition.

  1. Download executable dify-plugin binary from the release page of forked demo project
  2. Prepare your own difypkg file by dify-plugin plugin package command
  3. Generate new key pair for signing and verification 
    dify-plugin signature generate -f myorg
    • This step will generate myorg.private.pem and myorg.public.pem
  4. Sign your difypkg with myorg.private.pem 
    dify-plugin signature sign my-custom-plugin.difypkg -p myorg.private.pem
    • This step will generate my-custom-plugin.signed.difypkg
  5. You can verify signature of difypkg by verify command 
    dify-plugin signature verify my-custom-plugin.signed.difypkg -p myorg.public.pem
  6. Create new directory public_keys under your docker/volumes/plugin_daemon
  7. Place your myorg.public.pem (Public Key) under docker/volumes/plugin_daemon/public_keys
  8. Place docker-compose.override.yaml file with following content, on the next to your docker-compose.yaml 
    services:
  plugin_daemon:
    image: ghcr.io/kurokobo/dify-plugin-daemon:0.0.6-signature-p02-local
    environment:
      FORCE_VERIFYING_SIGNATURE: true
      THIRD_PARTY_SIGNATURE_VERIFICATION_ENABLED: true
      THIRD_PARTY_SIGNATURE_VERIFICATION_PUBLIC_KEYS: /app/storage/public_keys/myorg.public.pem
  9. Start your Dify and try installing my-custom-plugin.signed.difypkg.

✨ Related Links

Assets 5
Loading