langgenius/dify-plugin-daemon
1
0
Fork 0
mirror of https://github.com/langgenius/dify-plugin-daemon.git synced 2026-07-21 17:25:23 -04:00
Code Issues 111 Packages Projects Releases 10 Wiki Activity

[PR #137] [MERGED] feat: allow signing and verifying plugin with user provided keys #330

New Issue
Closed
opened 2026-02-16 01:15:35 -05:00 by yindo · 0 comments
yindo commented 2026-02-16 01:15:35 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/langgenius/dify-plugin-daemon/pull/137
Author: @kurokobo
Created: 3/23/2025
Status: ✅ Merged
Merged: 4/6/2025
Merged by: @Yeuoly

Base: main ← Head: sign

📝 Commits (4)

  • ee1a0dc feat: add signature subcommand to cli to generate key pair, sign, and verify difypkg file
  • 6f75bcc feat: verify plugin with public keys specified in environment variable in addition to official one
  • c8fc790 fix: move test files to testdata
  • 0174775 feat: add tests for third-party signature verification

📊 Changes

26 files changed (+1167 additions, -169 deletions)

View changed files

📝 .env.example (+6 -0)
📝 cmd/commandline/main.go (+7 -0)
➕ cmd/commandline/signature.go (+70 -0)
➕ cmd/commandline/signature/generate.go (+53 -0)
➕ cmd/commandline/signature/sign.go (+57 -0)
➕ cmd/commandline/signature/signature_test.go (+227 -0)
➕ cmd/commandline/signature/testdata/dummy_plugin.difypkg (+0 -0)
➕ cmd/commandline/signature/verify.go (+57 -0)
📝 internal/core/plugin_manager/manager.go (+2 -2)
📝 internal/service/plugin_decoder.go (+12 -6)
📝 internal/types/app/config.go (+5 -0)
📝 pkg/plugin_packager/decoder/helper.go (+11 -1)
📝 pkg/plugin_packager/decoder/verifier.go (+54 -6)
📝 pkg/plugin_packager/decoder/zip.go (+21 -2)
📝 pkg/plugin_packager/packager_test.go (+353 -61)
📝 pkg/plugin_packager/signer/sign.go (+3 -91)
➕ pkg/plugin_packager/signer/withkey/sign_with_key.go (+101 -0)
📝 pkg/plugin_packager/testdata/.difyignore (+0 -0)
📝 pkg/plugin_packager/testdata/_assets/test.svg (+0 -0)
📝 pkg/plugin_packager/testdata/ignored (+0 -0)

...and 6 more files

📄 Description

✨ New sub commands for CLI

Ready-to-Use binaries: https://github.com/kurokobo/dify-plugin-daemon/releases/tag/0.0.6%2Bsignature%2Bp04

# generate new key pair with specified name; 
dify-plugin signature generate -f myorg

# sign existing difypkg with specified private key
dify-plugin signature sign ./mypkg.difypkg -p myorg.private.pem

# verify existing difypkg with both official public key and specified public key (for testing purpose)
dify-plugin signature verify ./mypkg.difypkg -p myorg.public.pem

✨ New environment variables for daemon

Ready-to-Use container images: https://github.com/kurokobo/dify-plugin-daemon/pkgs/container/dify-plugin-daemon

# Enable or disable third-party signature verification for plugins
# Set to "true" to allow verification using additional public keys specified in THIRD_PARTY_SIGNATURE_VERIFICATION_PUBLIC_KEYS
THIRD_PARTY_SIGNATURE_VERIFICATION_ENABLED=false

# A comma-separated list of file paths to public keys in addition to the official public key for signature verification
THIRD_PARTY_SIGNATURE_VERIFICATION_PUBLIC_KEYS=

✨ Example Configuration Steps

For Self-Hosted Dify 1.0+ only. Not applicable for Cloud edition.

  1. Download executable dify-plugin binary from the release page of forked demo project
  2. Prepare your own difypkg file by dify-plugin plugin package command
  3. Generate new key pair for signing and verification 
    dify-plugin signature generate -f myorg
    • This step will generate myorg.private.pem and myorg.public.pem
  4. Sign your difypkg with myorg.private.pem 
    dify-plugin signature sign my-custom-plugin.difypkg -p myorg.private.pem
    • This step will generate my-custom-plugin.signed.difypkg
  5. You can verify signature of difypkg by verify command 
    dify-plugin signature verify my-custom-plugin.signed.difypkg -p myorg.public.pem
  6. Create new directory public_keys under your docker/volumes/plugin_daemon
  7. Place your myorg.public.pem (Public Key) under docker/volumes/plugin_daemon/public_keys
  8. Place docker-compose.override.yaml file with following content, on the next to your docker-compose.yaml 
    services:
  plugin_daemon:
    image: ghcr.io/kurokobo/dify-plugin-daemon:0.0.6-signature-p04-local
    environment:
      FORCE_VERIFYING_SIGNATURE: true
      THIRD_PARTY_SIGNATURE_VERIFICATION_ENABLED: true
      THIRD_PARTY_SIGNATURE_VERIFICATION_PUBLIC_KEYS: /app/storage/public_keys/myorg.public.pem
  9. Start your Dify and try installing my-custom-plugin.signed.difypkg.

✅ TODO

Closes #120

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/langgenius/dify-plugin-daemon/pull/137 **Author:** [@kurokobo](https://github.com/kurokobo) **Created:** 3/23/2025 **Status:** ✅ Merged **Merged:** 4/6/2025 **Merged by:** [@Yeuoly](https://github.com/Yeuoly) **Base:** `main` ← **Head:** `sign` --- ### 📝 Commits (4) - [`ee1a0dc`](https://github.com/langgenius/dify-plugin-daemon/commit/ee1a0dca151b83bb7f40bd3e2190c03f92b2a3ff) feat: add signature subcommand to cli to generate key pair, sign, and verify difypkg file - [`6f75bcc`](https://github.com/langgenius/dify-plugin-daemon/commit/6f75bcca4345259cdc19e1688dfbf72cb040eda9) feat: verify plugin with public keys specified in environment variable in addition to official one - [`c8fc790`](https://github.com/langgenius/dify-plugin-daemon/commit/c8fc7907c98a54adc125cb1f45b7c86b070c7d55) fix: move test files to testdata - [`0174775`](https://github.com/langgenius/dify-plugin-daemon/commit/01747753f7d5043c7d42212f24dbe439dbb9bc90) feat: add tests for third-party signature verification ### 📊 Changes **26 files changed** (+1167 additions, -169 deletions) <details> <summary>View changed files</summary> 📝 `.env.example` (+6 -0) 📝 `cmd/commandline/main.go` (+7 -0) ➕ `cmd/commandline/signature.go` (+70 -0) ➕ `cmd/commandline/signature/generate.go` (+53 -0) ➕ `cmd/commandline/signature/sign.go` (+57 -0) ➕ `cmd/commandline/signature/signature_test.go` (+227 -0) ➕ `cmd/commandline/signature/testdata/dummy_plugin.difypkg` (+0 -0) ➕ `cmd/commandline/signature/verify.go` (+57 -0) 📝 `internal/core/plugin_manager/manager.go` (+2 -2) 📝 `internal/service/plugin_decoder.go` (+12 -6) 📝 `internal/types/app/config.go` (+5 -0) 📝 `pkg/plugin_packager/decoder/helper.go` (+11 -1) 📝 `pkg/plugin_packager/decoder/verifier.go` (+54 -6) 📝 `pkg/plugin_packager/decoder/zip.go` (+21 -2) 📝 `pkg/plugin_packager/packager_test.go` (+353 -61) 📝 `pkg/plugin_packager/signer/sign.go` (+3 -91) ➕ `pkg/plugin_packager/signer/withkey/sign_with_key.go` (+101 -0) 📝 `pkg/plugin_packager/testdata/.difyignore` (+0 -0) 📝 `pkg/plugin_packager/testdata/_assets/test.svg` (+0 -0) 📝 `pkg/plugin_packager/testdata/ignored` (+0 -0) _...and 6 more files_ </details> ### 📄 Description ### ✨ New sub commands for CLI **Ready-to-Use binaries**: https://github.com/kurokobo/dify-plugin-daemon/releases/tag/0.0.6%2Bsignature%2Bp04 ```bash # generate new key pair with specified name; dify-plugin signature generate -f myorg # sign existing difypkg with specified private key dify-plugin signature sign ./mypkg.difypkg -p myorg.private.pem # verify existing difypkg with both official public key and specified public key (for testing purpose) dify-plugin signature verify ./mypkg.difypkg -p myorg.public.pem ``` ### ✨ New environment variables for daemon **Ready-to-Use container images**: https://github.com/kurokobo/dify-plugin-daemon/pkgs/container/dify-plugin-daemon ```bash # Enable or disable third-party signature verification for plugins # Set to "true" to allow verification using additional public keys specified in THIRD_PARTY_SIGNATURE_VERIFICATION_PUBLIC_KEYS THIRD_PARTY_SIGNATURE_VERIFICATION_ENABLED=false # A comma-separated list of file paths to public keys in addition to the official public key for signature verification THIRD_PARTY_SIGNATURE_VERIFICATION_PUBLIC_KEYS= ``` ### ✨ Example Configuration Steps For Self-Hosted Dify 1.0+ only. Not applicable for Cloud edition. 1. Download executable `dify-plugin` binary from [the release page of forked demo project](https://github.com/kurokobo/dify-plugin-daemon/releases/tag/0.0.6%2Bsignature%2Bp04) - This is built by GHA, you can review [the build logs](https://github.com/kurokobo/dify-plugin-daemon/actions) and [its source code](https://github.com/kurokobo/dify-plugin-daemon/tree/sign-demo) 2. Prepare your own difypkg file by `dify-plugin plugin package` command 3. Generate new key pair for signing and verification ```bash dify-plugin signature generate -f myorg ``` - This step will generate `myorg.private.pem` and `myorg.public.pem` 4. Sign your difypkg with `myorg.private.pem` ```bash dify-plugin signature sign my-custom-plugin.difypkg -p myorg.private.pem ``` - This step will generate `my-custom-plugin.signed.difypkg` 5. You can verify signature of difypkg by `verify` command ```bash dify-plugin signature verify my-custom-plugin.signed.difypkg -p myorg.public.pem ``` 5. Create new directory `public_keys` under your `docker/volumes/plugin_daemon` 7. Place your `myorg.public.pem` (Public Key) under `docker/volumes/plugin_daemon/public_keys` 8. Place `docker-compose.override.yaml` file with following content, on the next to your `docker-compose.yaml` ```yaml services: plugin_daemon: image: ghcr.io/kurokobo/dify-plugin-daemon:0.0.6-signature-p04-local environment: FORCE_VERIFYING_SIGNATURE: true THIRD_PARTY_SIGNATURE_VERIFICATION_ENABLED: true THIRD_PARTY_SIGNATURE_VERIFICATION_PUBLIC_KEYS: /app/storage/public_keys/myorg.public.pem ``` 9. Start your Dify and try installing `my-custom-plugin.signed.difypkg`. ### ✅ TODO - [x] Test with Dify 1.1.2 - [x] Add example override file for demonstration - [x] Reduce the likelihood that the PRIVATE_KEY will be unintentionally embedded - [x] Update dify-docs if this PR is acceptable: https://github.com/langgenius/dify-docs/pull/677 Closes #120 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-02-16 01:15:35 -05:00
yindo closed this issue 2026-02-16 01:15:35 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Windows
bug
cmd
documentation
enhancement
go
good first issue
plugin-daemon
pull-request
Mirrored from GitHub Pull Request
 question
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify-plugin-daemon#330
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?