Signing and trust
Status: Partly implemented. The Celestial website signs its mod index and its
.clpkdownloads with the site’s Ed25519 key, and moderators review every new project; author keys (clight keygen,clight sign) and per-key trust on the Mods screen are Planned. Packages from authors are unsigned today.
Every mod runs in the sandbox, so a signature never grants rights: it tells players who published a file and that nothing changed since.
What protects players today
| Layer | What it does |
|---|---|
| The sandbox | A mod can’t reach files outside its folder, start programs or use the network (Security, the sandbox and capabilities) |
| Website checks | Uploads with native code, unsafe paths or a broken manifest are refused (Packaging a .clmod) |
| Website scan | Each file is scanned for things a sandboxed mod has no reason to contain; flagged files go to moderators |
| Review | A moderator checks every new project before it is public (Distribution) |
| StarRinth | Mods the Celestial team checked by hand and trust to work carry the StarRinth badge |
| Site signature | index.json, versions.json, release.json and .clpk downloads are signed with the site’s Ed25519 key (public key at /api/clight/key), so a client or launcher can check that a download really came from the site |
| Hashes | Every file has SHA-256 and SHA-512 on the website and in the index |
Planned: author signatures
clight keygen <name>creates an Ed25519 key pair;clight signaddsMETA-INF/CLIGHT.SIGto a.clmod.- The Mods screen shows the signer’s fingerprint, remembers it per mod (trust on first use), and warns when a new version of a mod is signed by a different key or not at all.
- Signatures cover every file of the package, which
clight packwrites reproducibly (sorted entries, fixed timestamps), so the same sources give the same bytes. - Keep private keys out of repositories; in CI pass them through a secret.