GET /api/plugins/:slug/releases/:version
GET /api/plugins/:slug/releases/latest

{
  "slug": "my-plugin",
  "version": "1.4.0",
  "assets": [
    { "name": "my-plugin-linux-x64.zip", "url": "https://github.com/…", "size": 1234567 }
  ],
  "integrity": {
    "jws": "eyJhbGciOiJFZERTQSIsImtpZCI6Ij…",
    "assets": [
      {
        "name": "my-plugin-linux-x64.zip",
        "sha256": "abcdef…",
        "size": 1234567,
        "contentType": "application/zip",
        "arch": "x64",
        "os": "linux",
        "attestation": null
      }
    ]
  }
}

GET /.well-known/registry-key.json

import { compactVerify, importJWK, type JWK } from 'jose'
import { verifyAssetHash } from '@tabularium/manifest'

const REGISTRY = 'https://registry.example.com'

// In-memory JWKS cache. In production persist between sessions and
// add a periodic refresh — this just shows the kid-miss refresh path.
let jwksCache: { keys: JWK[] } | null = null
async function getKey(kid: string): Promise<JWK> {
  if (jwksCache) {
    const hit = jwksCache.keys.find((k) => k.kid === kid)
    if (hit) return hit
  }
  const res = await fetch(`${REGISTRY}/.well-known/registry-key.json`)
  jwksCache = (await res.json()) as { keys: JWK[] }
  const hit = jwksCache.keys.find((k) => k.kid === kid)
  if (!hit) throw new Error(`No registry key for kid ${kid}`)
  return hit
}

async function verifyAndDownload(slug: string, version: string, assetName: string) {
  // 1. Fetch the release
  const release = await (await fetch(`${REGISTRY}/api/plugins/${slug}/releases/${version}`)).json()
  if (!release.integrity?.jws) throw new Error(`No signed integrity for ${slug}@${version}`)

  // 2. Verify signature (layer 2)
  const header = JSON.parse(
    Buffer.from(release.integrity.jws.split('.')[0], 'base64url').toString(),
  )
  const jwk = await getKey(header.kid)
  const { payload } = await compactVerify(release.integrity.jws, await importJWK(jwk))
  const signed = JSON.parse(new TextDecoder().decode(payload))

  if (signed.slug !== slug || signed.version !== version) {
    throw new Error('Signed payload identity mismatch')
  }

  // 3. Find the asset in the signed list
  const signedAsset = signed.assets.find((a: { name: string }) => a.name === assetName)
  if (!signedAsset) throw new Error(`Asset ${assetName} not in signed integrity`)
  const downloadUrl = release.assets.find((a: { name: string }) => a.name === assetName)?.url
  if (!downloadUrl) throw new Error(`Missing download URL`)

  // 4. Download + verify hash (layer 1)
  const assetRes = await fetch(downloadUrl)
  if (!assetRes.body) throw new Error('No body')
  const ok = await verifyAssetHash(assetRes.body, signedAsset.sha256)
  if (!ok) throw new Error(`Hash mismatch for ${assetName} — asset tampered or corrupted`)

  // 5. (Optional) verify sigstore attestation bundle (layer 3)
  if (signedAsset.attestation) {
    // Use a sigstore client. The bundle is standard sigstore Bundle format.
    // await verifyAttestationBundle(signedAsset.attestation, signedAsset.sha256)
  }

  return { signedAsset, downloadUrl }
}

await verifyAndDownload('my-plugin', '1.4.0', 'my-plugin-linux-x64.zip')

{
  "keys": [
    { "kid": "current-kid",  "kty": "OKP", "crv": "Ed25519", "x": "…", "alg": "EdDSA", "use": "sig" },
    { "kid": "previous-kid", "kty": "OKP", "crv": "Ed25519", "x": "…", "alg": "EdDSA", "use": "sig" }
  ]
}