← Back to the developers overview

Every package is signed by its developer with their own Ed25519 key. Tobto.shop keeps only your public key, bound to your company — a package signed with someone else’s key does not pass.

1. Generate a key pair: openssl genpkey -algorithm ed25519 -out private-key.pem, then openssl pkey -in private-key.pem -pubout -out public-key.pem.
2. Send support only public-key.pem and the key name (key_id). Never share the private key or commit it to a repository.
3. Sign every build with the packager: it computes the SHA-256 of the final ZIP and signs it.

The publication JSON gains two fields:

"package_checksum": "<lowercase sha256 of the ZIP, 64 characters>",
"signature": {"algorithm": "Ed25519", "key_id": "my-key-id", "value": "<base64url without =, 86 characters>"}

• key_id is enrolled for your company and allowed for the declared trust_level.
• The SHA-256 of the uploaded ZIP equals package_checksum.
• The publication JSON (without signature and checksum) equals extension.json, theme.json or language-pack.json inside the archive.
• Code, version and compatibility in the submission form match the manifest.

Any change to the archive after signing — even repacking the same files — changes the SHA-256 and invalidates the signature. Build and sign once, submit exactly that ZIP.

Developer documentation