[2026 Plugins] Verify plugin signatures and trust metadata

[Godfrey-Delight]

Description

Authenticates plugin publishers and surfaces verification status prior to installation or dynamic execution in the registry and loader.

Closes #678

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Changes Made

• Created src/plugins/verifier.rs for Ed25519 SHA-256 binary signature verification supporting Stellar StrKey public keys (G...) and hex formats.
• Extended PluginManifest and InstalledPlugin registry schema to persist publisher, publisher_key, and verification_status with backward-compatible defaults.
• Integrated pre-load signature verification into PluginManager::load_plugin_diagnosed() to block execution of untrusted or invalid plugin binaries before libloading.
• Updated starforge plugin CLI commands (install, list, verify, audit, update) to display verification status and enforce require_signatures / trusted_publishers settings.
• Added comprehensive integration tests (tests/plugin_signature_verification.rs) and updated developer guidance in PLUGIN_TRUST.md.

Testing

How has this been tested?

Added dedicated integration test suite covering publisher authentication, key parsing, allowlists, and signature verification.

• Unit tests added/updated
• Integration tests added/updated
• Manual testing performed

Test Coverage

Describe what scenarios have been tested:

• Happy path: Successful installation, verification, listing (--json), and auditing of valid signed plugins.
• Edge cases: Unsigned plugin installation under default permissive settings, matching publisher public keys against trusted_publishers configuration.
• Error handling: Rejection of tampered plugin binaries (signature mismatch), malformed publisher key strings, untrusted publishers under allowlists, and forced signature requirement enforcement (require_signatures = true).

Code Quality Checklist

• My code follows the style guidelines of this project (cargo fmt)
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings (cargo clippy -- -D warnings)
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• The CI checks pass (format, clippy, tests)

Breaking Changes

• No breaking changes (backward compatible with existing starforge.db / plugins.json registries via #[serde(default)]).

Documentation

• README.md updated
• DEVELOPER_GUIDE.md updated (if applicable)
• API_REFERENCE.md updated (if applicable)
• PLUGIN_TRUST.md updated with publisher signature schema and verification workflows.

Screenshots (if applicable)

N/A (CLI output updated with Verification status columns and structured --json payload fields).

Additional Context

Fully satisfies issue requirements for verifying plugin signatures and trust metadata prior to execution.

[drips-wave]

@Godfrey-Delight Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits