pleb/plugin-helper
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add optional locked plugin download URLs

Browse Source
This commit is contained in:
pleb
2026-07-10 09:17:02 -07:00
parent 26def9609d
commit 538feae811
7 changed files with 121 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/DESIGN.md
+7
View File
@@ -162,6 +162,7 @@ id = "songcore"
repo = "Kylemc1413/SongCore"
tag = "v4.3.0"
asset = "SongCore-4.3.0.zip"
download_url = "https://github.com/Kylemc1413/SongCore/releases/download/v4.3.0/SongCore-4.3.0.zip"
sha256 = "..."
reason = "Pinned until dependent mods support newer SongCore"
@@ -170,9 +171,15 @@ id = "some-ui-mod"
repo = "example/some-ui-mod"
tag = "v1.2.1"
asset = "SomeUIMod.dll"
download_url = "https://github.com/example/some-ui-mod/releases/download/v1.2.1/SomeUIMod.dll"
sha256 = "..."
```
`download_url` is the optional concrete URL for the locked artifact. It should
point at the exact zip or DLL when the artifact is publicly downloadable, and
should be omitted for local builds, private/commercial packages, and packages
that must be reconstructed from source or a recipe.
The lockfile should be the source of truth for reproducible installs. `check` may propose newer versions, but `apply` should install what is present in a plan generated from the lockfile or from an explicit update command.
## Install State
docs/roadmap-01.md
+9 -9
View File
@@ -46,15 +46,15 @@ There is no urgent need to migrate the layout before the rest of the helper
settles, but new code should avoid assuming that downloads and per-install
state must always live together.
The version lock should eventually include structured source URLs for every
asset so the helper can fetch missing downloads itself. The lock already pins
the selected repo, tag, asset name, and checksum; adding source fields would
make the fetch path explicit for both GitHub release assets and BeatMods CDN
fallbacks. Hashes should remain useful audit metadata and a warning signal, but
the UX needs a recovery path for replaced upstream assets: report the mismatch,
show the expected and actual hashes, and let the user intentionally refresh or
re-lock after inspection instead of treating every mismatch as an unrecoverable
dead end.
The version lock includes an optional `download_url` for publicly downloadable
artifacts. That makes the fetch path explicit for both GitHub release assets and
BeatMods CDN fallbacks, while local builds and private/commercial packages can
leave it unset. A future helper command can use this field to fetch missing
downloads itself. Hashes should remain useful audit metadata and a warning
signal, but the UX needs a recovery path for replaced upstream assets: report
the mismatch, show the expected and actual hashes, and let the user
intentionally refresh or re-lock after inspection instead of treating every
mismatch as an unrecoverable dead end.
## Future: Nix-Orchestrated Plugin Sets