KFIF Plugin Package Specification v1.

Synchronized public edition. Canonical source: KFIF Enterprise backend documentation.

kfif-example-connector-1.0.0/
├── plugin.json          required
├── MANIFEST.sha256      required
├── SIGNATURE            required
├── src/connector.py     declared entrypoint
├── schemas/             optional
├── docs/                optional
├── tests/               optional
├── README.md            optional
└── LICENSE              optional

package_sha256 identifies every byte of the complete ZIP or TAR.GZ archive. MANIFEST.sha256 independently hashes every regular payload file except itself and SIGNATURE, using UTF-8, LF, lexical paths and lowercase SHA-256.

The embedded UTF-8 JSON SIGNATURE uses Ed25519 and the KFIF trust framework. Its signed claims bind plugin ID, version and the SHA-256 of the exact MANIFEST.sha256 bytes.

A cryptographically valid key is insufficient unless it is approved for plugin_publishing and matches the declared publisher key and owner.

• single top-level package root
• no absolute or traversal paths
• no symlinks, hardlinks, devices, sockets or FIFOs
• no duplicate, case-colliding or Unicode-ambiguous paths
• no nested archives
• bounded file count, sizes, depth and compression ratio
• host-controlled ownership and modes

inspect
→ enforce limits
→ verify package_sha256
→ verify payload manifest
→ verify publisher signature and trust
→ validate contract, compatibility and permissions
→ validate license requirement
→ stage with host ownership and modes
→ atomically register installed_disabled

Package identity is the immutable tuple of plugin ID, version and complete-archive digest. Same-version/different-bytes packages are rejected. Upgrades validate side-by-side before an atomic active-version switch and return to disabled. Rollback selects a previously validated identity; uninstall requires disabled state and preserves audit records.

Producers, installers, publishers, runtimes and test suites each have minimum requirements. Implementations must treat archives, paths, signatures, publisher state and plugin output as hostile and enforce fail-closed limits against confusion, downgrade, decompression, escalation and denial-of-service attacks.