api · omarchy-plugin-check

Everything on this site is built from static JSON that anyone can fetch, mirror and verify. No keys, no rate limits, no scan-on-demand. Paths are relative to https://prometheusroot.github.io/omarchy-plugin-check/.

endpoints

path	schema	content
api/v1/meta.json	api-meta	registry summary, providers (feed version, expiry, status), counts, rejected rows
api/v1/index.json	api-index	one row per plugin: combined verdict, basis, contested, per-provider verdicts
api/v1/by-repo.json	api-by-repo	repository (and previous names) → plugin ids
api/v1/plugins/<id>.json	api-plugin	every provider row + combined; listing, weekly activity, embedded reports
api/v1/plugins/<id>/<provider>/<commit>.json	statement	the verified in-toto statement (immutable)
store.json + .sig	store	compact signed snapshot: the CLI contract
store-manifest.json + .sig	store-manifest	signed client bundle manifest: sha256 + size of the files below
store-home.json · store-search.json · store-details.json	store-home / store-search / store-details	the store app bundle
providers.json + .sig	providers	the provider registry (when published with the snapshot)

Example: api/v1/plugins/io.github.letsfg.flights.json , statement api/v1/plugins/io.github.letsfg.flights/opc/26b1fa823756f164b472c7eab0d22f102044dc35.json. data/plugins.json is this site's own compact search index, not a stable API.

schemas

JSON Schema 2020-12, served at their $id: api-meta · api-index · api-by-repo · api-plugin · statement · predicate · feed-index · providers · store · store-manifest · store-home · store-search · store-details · common. The protocol (attestation, feed, registry, merge rules) is spec/PROTOCOL.md in the repository.

verify the snapshot

store.json and store-manifest.json carry detached SSH signatures (ed25519, namespace omarchy-plugin-check-snapshot). Verify before trusting any verdict, then reject an expired snapshot or a version lower than the last one you accepted:

curl -fsSLO https://prometheusroot.github.io/omarchy-plugin-check/store.json -O https://prometheusroot.github.io/omarchy-plugin-check/store.json.sig
curl -fsSL https://prometheusroot.github.io/omarchy-plugin-check/keys/allowed_signers -o allowed_signers
ssh-keygen -Y verify -f allowed_signers -I omarchy-plugin-check \
  -n omarchy-plugin-check-snapshot -s store.json.sig < store.json
jq -r '.expires, .version, .dev' store.json

The store bundle: verify store-manifest.json.sig the same way, then check that the sha256 and size of every listed file match (sha256sum), and use a plugin's api/v1/plugins/<id>.json only if its sha256 is the one store-details.json lists.

verify an attestation

Each review is an in-toto statement in a DSSE envelope inside a Sigstore bundle, signed keyless in the provider's GitHub Actions workflow. Fetch the bundle from the provider's feed (<feedUrl>/feed/v1/statements/<id>/<commit>.sigstore.json; identities on the providers page) and check it against the exact workflow identity:

cosign verify-blob-attestation --new-bundle-format \
  --bundle <commit>.sigstore.json \
  --certificate-identity '<exact workflow SAN from the registry>' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --type https://prometheusroot.github.io/omarchy-plugin-check/attestation/security-review/v1 \
  --check-claims=false        # the subject is a git commit, not a file

Then compare the statement's subject with what you install: subject[0].name must be git+<the marketplace repository> and subject[0].digest.gitCommit (or gitTree) your checkout's git rev-parse HEAD (HEAD^{tree}). The signing time (Rekor) must fall inside the provider's validity window.