Publisher keys

Sign the extension packages you publish, so the people installing them can tell the package came from you and has not been altered.

How signing works
Your private key never leaves your machine — not even to this page.
  1. Generate a keypair on your own machine:
    extension-sign keygen --out ./publisher.pem
  2. Register the public key it prints, below.
  3. Sign each release before you publish it:
    extension-sign sign --package ./extension.json --manifest ./manifest.json --key ./publisher.pem

Keep publisher.pem safe. It cannot be recovered — a lost key is replaced by registering a new one and revoking the old.

Loading…
Register a publisher name
This must match the publisher field in the packages you sign.