Package and version a plugin

Include plugin.json, the entry assembly, all required runtime dependencies and resources. Keep the private publisher key outside the package.

Finish before signing

Build all files, set the version and minimum/maximum Host API range, then sign and verify the complete package. Every shipped DLL must be authenticated. Do not overlay compiler output onto an already signed plugin directory.

Use a new version for a published package. An official project signature is reserved for project-owned releases; community signing and user consent do not confer official status.

Distribution

Supply accurate publisher/source information, hashes and supported update metadata. Source enrollment controls delivery and does not grant execution trust. Test the archive after extraction and with each supported Core line.

The public SDK and independent examples have their own MIT license; the main application and official plugin implementation have separate terms. Review the licenses shipped with the exact packages.

See Manifest and Security.