Publishing

About 493 wordsAbout 2 min

2026-08-14

You can package your plugin and distribute it through the plugin market or by private sharing.

Package the Plugin

Set <CreateSrpx>true</CreateSrpx> in your project file; every build produces srpx/<ProjectName>.srpx:

dotnet build -c Release

The package is a ZIP whose root contains manifest.yml, the entrance assembly, and all external package dependencies; host-provided assemblies are excluded automatically by the packaging target.
Manual install: place the .srpx in data/cache/plugin-packages and restart the desktop application. A package with the same id replaces the whole directory, which is how updates work.

List Your Plugin on the Market

The built-in market loads its index from SECTL/SecRandom-PluginIndex. The index is rebuilt automatically by that repository's workflow on every push and nightly: it scans plugins/<id>.yaml, fetches the latest release's unique .srpx asset via the GitHub API, parses the SHA-256 block from the release note, aggregates index.json, signs it with an Ed25519 private key, and uploads it to the fixed release tag generated.

Author submission flow:

Package the plugin, then generate the submission metadata with scripts/publish-plugin.ps1 from the client source repository SECTL/SecRandom:
```
dotnet build -c Release     # produces srpx\My.Plugin.srpx
.\scripts\publish-plugin.ps1 -SrpxPath .\srpx\My.Plugin.srpx -RepoOwner MyGitHub -RepoName my-plugin-repo
```
The script reads manifest.yml from inside the package, writes plugins/<id>.yaml next to the .srpx (optional -ProjectUrl / -ReadmeUrl / -IconUrl), and prints the SHA-256 block.
Publish a .srpx release in your GitHub repository: tag it v<version from manifest>, attach exactly one .srpx asset, and embed the SHA-256 block in the release note:
```

```
The release must contain exactly one .srpx asset for the index generator to match.
Fork SECTL/SecRandom-PluginIndex, add plugins/<id>.yaml under its plugins/ directory, and open a PR. Once merged, the workflow rebuilds and signs index.json; later updates are picked up automatically by the nightly build, with no further PR needed.

The generated plugins/<id>.yaml looks roughly like this:

id: com.example.plugin
name: SecRandom 示例插件
description: 演示 SecRandom 插件 API 的最小示例插件
author: SECTL
version: 1.0.0
apiVersion: "3.1.0"
repoOwner: SECTL
repoName: SecRandom-ExamplePlugins
projectUrl: https://github.com/SECTL/SecRandom-ExamplePlugins
dependencies:
  - id: some.other.plugin
    required: true

Market client behavior:

The client downloads mirror-first (ghproxy.sectl.cn) with a GitHub fallback, verifies the whole index.json signature with the embedded Ed25519 public key, and verifies each package SHA-256 before staging.
Dependencies are installed in topological order (with cycle detection); missing or circular dependencies report an error.
Compatibility is gated by the apiVersion major and minimumHostVersion; incompatible plugins are marked and cannot be installed.

c13ca-Update start.md and add MacOS guideson 10/31/26

Copyright

License under:CC BY-NC-SA 4.0

Publishing

Package the Plugin

List Your Plugin on the Market

Security Note

Contributors

Changelog

Copyright