feat(plugins): install signed registry binaries

crates/temps-cli/src/commands/serve/console.rs

@@ -1257,6 +1257,9 @@ pub struct ConsoleApiParams {
     /// connection handling. The watcher's writes reach the route table through
     /// the `route_table_changes` NOTIFY path, not through this handle.
     pub traefik_discovery: Arc<temps_deployer::traefik_discovery::TraefikDiscoveryHandle>,
+    /// Authenticated external-plugin registry configuration resolved from the
+    /// paired `temps serve` bootstrap options.
+    pub external_plugin_registry: temps_external_plugins::catalog::RegistryConfig,
 }
 
 /// Build a ClickHouse-backed metrics store from the server config, or `None`
@@ -2179,6 +2182,7 @@ pub async fn start_console_api(params: ConsoleApiParams) -> anyhow::Result<()> {
         update_status,
         self_updater,
         traefik_discovery,
+        external_plugin_registry,
     } = params;
 
     // Count panics for the anonymous `error_summary` telemetry event. Only
@@ -2666,7 +2670,8 @@ pub async fn start_console_api(params: ConsoleApiParams) -> anyhow::Result<()> {
     // through the proxy, so a plugin that has to hand out a URL to something
     // outside the request (a sandboxed agent, a webhook receiver) cannot
     // construct one without being told the address the proxy listens on.
-    .with_proxy_address(&config.address);
+    .with_proxy_address(&config.address)
+    .with_registry(external_plugin_registry);
     let external_plugins_plugin = Box::new(temps_external_plugins::ExternalPluginsPlugin::new(
         external_plugin_config,
     ));

crates/temps-cli/src/commands/serve/mod.rs

@@ -133,6 +133,16 @@ pub struct ServeCommand {
     /// sibling proxy has a fixed address to forward console traffic to.
     #[arg(long, value_enum, default_value_t = ServeRole::All, env = "TEMPS_ROLE")]
     pub role: ServeRole,
+
+    /// Key ID expected on signed external-plugin registry documents.
+    /// Must be configured together with --plugin-registry-public-key.
+    #[arg(long, env = "TEMPS_PLUGIN_REGISTRY_KEY_ID")]
+    pub plugin_registry_key_id: Option<String>,
+
+    /// Hex-encoded 32-byte Ed25519 public key used to authenticate the
+    /// external-plugin registry. Must be paired with --plugin-registry-key-id.
+    #[arg(long, env = "TEMPS_PLUGIN_REGISTRY_PUBLIC_KEY")]
+    pub plugin_registry_public_key: Option<String>,
 }
 
 impl ServeCommand {
@@ -207,6 +217,12 @@ impl ServeCommand {
             );
         }
 
+        let external_plugin_registry =
+            temps_external_plugins::catalog::registry_config_from_anchor(
+                self.plugin_registry_key_id.as_deref(),
+                self.plugin_registry_public_key.as_deref(),
+            )?;
+
         let serve_config = Arc::new(temps_config::ServerConfig::new(
             self.address.clone(),
             self.database_url.clone(),
@@ -738,6 +754,7 @@ impl ServeCommand {
             update_status,
             self_updater,
             traefik_discovery: traefik_discovery_handle,
+            external_plugin_registry,
         };
 
         if self.role == ServeRole::Console {

crates/temps-core/src/sensitive_action.rs

@@ -16,6 +16,9 @@ use thiserror::Error;
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub enum SensitiveAction {
     CreateApiKey,
+    InstallExternalPlugin {
+        name: String,
+    },
     RotateApiKey {
         api_key_id: i32,
     },
@@ -86,6 +89,7 @@ impl SensitiveAction {
     pub fn as_str(&self) -> &'static str {
         match self {
             Self::CreateApiKey => "create_api_key",
+            Self::InstallExternalPlugin { .. } => "install_external_plugin",
             Self::RotateApiKey { .. } => "rotate_api_key",
             Self::DeleteEnvironment { .. } => "delete_environment",
             Self::DrainNode { .. } => "drain_node",
@@ -172,6 +176,13 @@ mod tests {
     #[test]
     fn action_identifiers_are_stable_and_resource_independent() {
         assert_eq!(SensitiveAction::CreateApiKey.as_str(), "create_api_key");
+        assert_eq!(
+            SensitiveAction::InstallExternalPlugin {
+                name: "example".to_string(),
+            }
+            .as_str(),
+            "install_external_plugin"
+        );
         assert_eq!(
             SensitiveAction::RotateClusterCa.as_str(),
             "rotate_cluster_ca"

crates/temps-external-plugins/Cargo.toml

@@ -18,6 +18,14 @@ temps-entities = { path = "../temps-entities" }
 temps-presets = { path = "../temps-presets" }
 sea-orm = { workspace = true }
 async-trait = { workspace = true }
+anyhow = { workspace = true }
+base64 = { workspace = true }
+ed25519-dalek = "2.2.0"
+hex = { workspace = true }
+reqwest = { workspace = true }
+sha2 = { workspace = true }
+thiserror = { workspace = true }
+url = { workspace = true }
 axum = { workspace = true }
 chrono = { workspace = true }
 futures = { workspace = true }
@@ -38,3 +46,4 @@ libc = { workspace = true }
 
 [dev-dependencies]
 tempfile = { workspace = true }
+tracing-subscriber = { workspace = true }