Skip to content

plugins-lock.json

plugins-lock.json records the exact versions and artifact locations that were resolved and installed, ensuring repeatable environments across machines and deployments. It is generated and updated by tooling, not hand-edited.

manifest-lock.json
{
"version": "1.0",
"plugins": {
"ad-aures/custom-rss": {
"version": "dev-main",
"source": {
"url": "https://github.com/ad-aures/castopod-plugins.git",
"reference": "20433933ab4e42bb44f8367ab72ee1ffae723019"
},
"dist": {
"url": "https://plugins.castopod.org/static/plugins/db/cf/15/ad-aures_custom-rss_dev-main.zip",
"path": "",
"checksum": "dbcf153694f09c5788e6cccbca2db4cb9605faa7c1399d59960edee00fa9f853"
}
}
// ...
}
}

The lockfile schema version, used by tooling to parse and validate the file across releases; not related to any plugin version. Changing schema may alter field shapes or semantics.

A mapping from a plugin identifier to a locked entry that captures the exact resolved version, the source and distribution details. This section is the authoritative record for reinstalls.

Each plugin entry contains:

  • version: The exact version (or branch reference such as dev-main) that was resolved and installed for this plugin, guaranteeing consistent reinstallation.

  • source: Describes the canonical source of the plugin’s code used to produce the distribution artifact.

    • url: The upstream Git repository.
    • path: The root path of the plugin.
    • reference: The exact commit or revision used, for provenance and reproducibility.
  • dist: Points to the installable artifact and verifies its integrity.

    • url: A direct link to the packaged plugin archive that the installer downloads.
    • checksum: A cryptographic hash of the archive used to validate integrity and prevent tampering during install.