Sign a code plugin

Sign your plugin's builds with your own key, here in the browser. Readers check that signature before they load a plugin, so they know each version comes from the same author. Your key and your files stay on this computer.

paperpaw-sign sign-plugin <file> --key <key>

1. Your key

   Signing a build with your key says it is yours. A reader remembers the key when a plugin is first installed, and warns when an update is signed by another, so sign every version with the same key. If you have signed before, choose that key file.

   Choose your key file No key chosen yet

   Signing for the first time? Make a key: the page saves it in your downloads as paperpaw-author.key.

   Make a new key

   The key file is yours alone. Keep it private and safe, with a copy somewhere apart: whoever has it can sign plugins in your name, and without it no update of yours installs without a warning. Never upload it, to the plugin library or anywhere else; the library only ever needs the signed builds.

2. Choose the builds

   Choose your plugin's .ppn files, one for each reader, as paperpaw-sign pack makes them. A signature a file has already is replaced.

   Choose .ppn files No files chosen yet

3. Sign them

   Each file is signed with your key, checked as a reader checks it, and offered for saving under its own name.

   Sign the builds

Nothing leaves your computer

The page reads your key and your files in the browser and signs them there. It cannot send them anywhere: this site does not let the page fetch anything. The key is forgotten when you close or reload the page.

Signing without the browser

PaperPaw's signing tool does the same on your own computer or in your CI, with the same key file. It makes a key too:

paperpaw-sign key paperpaw-author.key
paperpaw-sign sign-plugin my-plugin-x4.ppn --key paperpaw-author.key