stacklok / stacklok/toolhive

[plugins] Phase 5c: marketplace generate + signing (THV-0077)

Open
#5,530 0 comments 0 reactions 1 assignee View on GitHub

@JAORMX is already working on this.

Since Jun 15, 2026.

enhancement
Dominant language
Go
Stars
2.2k
Forks
300
Avg merge
1d 15h
Merged PRs (30d)
184

Description

Goal: Generate marketplace.json from OCI-distributed plugins and add signature support. No toolhive-core dependency — fully parallel.

Deliverables:

  • pluginsvc/marketplace.go — GenerateMarketplace emitting git-source marketplace.json (OCI refs are not valid native sources; emit git sources with sha pinning).
  • --require-signature → cosign via OCI Referrers API (subject + GET /v2/<name>/referrers/<digest>). New dep: cosign/sigstore. Sequence signing last.

Dependency/gate: no core dependency; can start any time after Phase 2. Parallel with P5a/P5b/P5d.

Testing/exit gate: marketplace-generator unit; signature-required failure paths.

Part of stacklok/toolhive#5525
Refs RFC PR stacklok/toolhive-rfcs#77

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.