data(registry): baseline checksums for published free plugins (TOFU; pipeline-generated from v1.0.1 on)

[acamarata]

Summary

Populates the flat checksum field (sha256, lowercase hex, no prefix — the field the CLI installer actually reads and enforces, per internal/plugin/registry_parse.go / installer_locked.go) for every free-registry entry that had none, so nself plugin install can verify what it downloads.

Coverage: 1/129 → 52/129 (the pre-existing ollama placeholder had an empty "" checksum; it now carries a real one, plus 51 newly-populated entries).

These are trust-on-first-use (TOFU) baselines, not proof of prior integrity. A checksum computed from the asset currently served on the release matches that asset by construction — it does not attest the tarball was unaltered before this measurement. What it buys is tamper detection from this point forward: if the served asset ever changes without a matching registry update, installs will start failing the check. From v1.0.1 onward, checksums are produced in the publish pipeline directly from the freshly-built tarball (plugins#83's build-and-upload-tarballs.sh), which is a stronger guarantee than this backfill.

How

For each free entry lacking checksum (excluding the 8 plugins#81 bumps to 1.0.1 — content-progress, cron, donorbox, maintenance, notifications, notify, search, storage): downloaded the exact tarball asset GitHub serves at releases/download/v<version>/<name>-<version>.tar.gz, where <version> is that entry's own registry.json version (not "latest" — a few plugins sit on older/newer tags than the bulk v1.0.0 set), and hashed the actual bytes served — not the source tree, which would not verify what the installer downloads. Reused the download+hash approach from plugins#83's scripts/verify-published-checksums.sh (not vendored here; that script lands with #83).

Missing assets — real registry defects, not fixed here

70 of 121 candidate entries have no tarball published for the version registry.json currently states. I did not invent a checksum for these or substitute a different published version — that would attest to bytes a user installing at the stated version would never receive. Left with no checksum field, same as before this PR.

• 11 entries: no release tag exists at all for the stated version (ci@1.0.1, entitlements@1.2.0, family-gedcom@0.0.1, nself-cloud@0.1.0, nself-image@0.1.0, nself-pdf@0.1.0, nself-scan@0.1.0, plugin-clawde@0.1.0, plugin-gauth@0.1.0, plugin-llm-gateway@0.1.0, plugin-retrieval@0.1.0). Of these, ci and family-gedcom have been published — just at other versions (v1.0.0, v1.1.0/1.1.1/1.1.2/1.1.5/1.1.6/1.1.7/1.1.9) — so registry.json's stated version for those two is stale, not merely unpublished.
• 59 entries: the release tag for the stated version exists, but no <name>-<version>.tar.gz asset is in it (e.g. every *@1.1.2 entry in the table below — checked against the full 29-asset manifest of the v1.1.2 release, which is actually a partial re-release of a different, mostly-1.0.0 plugin set, not these). Their published download_url/tarball links 404 today, independent of this PR.

Full list:

70 plugins with no matching published asset (click to expand)

Plugin	registry.json version	Issue
access-controls	1.1.2	v1.1.2 release exists, no access-controls-1.1.2.tar.gz asset in it
admin-api	1.1.2	v1.1.2 release exists, no admin-api-1.1.2.tar.gz asset in it
analytics	1.1.2	v1.1.2 release exists, no analytics-1.1.2.tar.gz asset in it
audit-analytics	1.0.0	v1.0.0 release exists, no audit-analytics-1.0.0.tar.gz asset in it
auth-enterprise	1.1.2	v1.1.2 release exists, no auth-enterprise-1.1.2.tar.gz asset in it
byok	1.1.2	v1.1.2 release exists, no byok-1.1.2.tar.gz asset in it
cdc	1.0.0	v1.0.0 release exists, no cdc-1.0.0.tar.gz asset in it
cdn	1.1.2	v1.1.2 release exists, no cdn-1.1.2.tar.gz asset in it
ci	1.0.1	no release tag v1.0.1 exists (published at v1.0.0/v1.1.5/v1.1.6/v1.1.7/v1.1.9 instead)
cloudflare	1.1.2	v1.1.2 release exists, no cloudflare-1.1.2.tar.gz asset in it
compliance	1.1.2	v1.1.2 release exists, no compliance-1.1.2.tar.gz asset in it
content-safety	1.0.0	v1.0.0 release exists, no content-safety-1.0.0.tar.gz asset in it
crdt	1.1.2	v1.1.2 release exists, no crdt-1.1.2.tar.gz asset in it
ddns	1.1.2	v1.1.2 release exists, no ddns-1.1.2.tar.gz asset in it
devices	1.1.2	v1.1.2 release exists, no devices-1.1.2.tar.gz asset in it
documents	1.1.2	v1.1.2 release exists, no documents-1.1.2.tar.gz asset in it
email	1.0.0	v1.0.0 release exists, no email-1.0.0.tar.gz asset in it
encryption	1.0.0	v1.0.0 release exists, no encryption-1.0.0.tar.gz asset in it
entitlements	1.2.0	no release tag v1.2.0 exists
event-bus	1.0.0	v1.0.0 release exists, no event-bus-1.0.0.tar.gz asset in it
family-ancestry	1.1.2	v1.1.2 release exists, no family-ancestry-1.1.2.tar.gz asset in it
family-familysearch	1.1.2	v1.1.2 release exists, no family-familysearch-1.1.2.tar.gz asset in it
family-gedcom	0.0.1	no release tag v0.0.1 exists (published at v1.0.0/v1.1.0/v1.1.1/v1.1.2/v1.1.5/v1.1.6/v1.1.7/v1.1.9 instead — registry version is stale)
family-myheritage	1.1.2	v1.1.2 release exists, no family-myheritage-1.1.2.tar.gz asset in it
family-wikitree	1.1.2	v1.1.2 release exists, no family-wikitree-1.1.2.tar.gz asset in it
file-processing	1.1.2	v1.1.2 release exists, no file-processing-1.1.2.tar.gz asset in it
functions-v8	1.1.2	v1.1.2 release exists, no functions-v8-1.1.2.tar.gz asset in it
game-metadata	1.1.2	v1.1.2 release exists, no game-metadata-1.1.2.tar.gz asset in it
geocoding	1.1.2	v1.1.2 release exists, no geocoding-1.1.2.tar.gz asset in it
hipaa	1.1.2	v1.1.2 release exists, no hipaa-1.1.2.tar.gz asset in it
home	1.1.2	v1.1.2 release exists, no home-1.1.2.tar.gz asset in it
idme	1.1.2	v1.1.2 release exists, no idme-1.1.2.tar.gz asset in it
job-queue	1.0.0	v1.0.0 release exists, no job-queue-1.0.0.tar.gz asset in it
linkedin	1.1.2	v1.1.2 release exists, no linkedin-1.1.2.tar.gz asset in it
mail	1.0.0	v1.0.0 release exists, no mail-1.0.0.tar.gz asset in it
media-processing	1.1.2	v1.1.2 release exists, no media-processing-1.1.2.tar.gz asset in it
meetings	1.1.2	v1.1.2 release exists, no meetings-1.1.2.tar.gz asset in it
nself-cloud	0.1.0	no release tag v0.1.0 exists
nself-eval-gate	1.0.0	v1.0.0 release exists, no nself-eval-gate-1.0.0.tar.gz asset in it
nself-geo	1.1.0	v1.1.0 release exists, no nself-geo-1.1.0.tar.gz asset in it
nself-image	0.1.0	no release tag v0.1.0 exists
nself-pdf	0.1.0	no release tag v0.1.0 exists
nself-scan	0.1.0	no release tag v0.1.0 exists
nself-sync	1.1.2	v1.1.2 release exists, no nself-sync-1.1.2.tar.gz asset in it
nself-vault	1.0.0	v1.0.0 release exists, no nself-vault-1.0.0.tar.gz asset in it
object-storage	1.1.2	v1.1.2 release exists, no object-storage-1.1.2.tar.gz asset in it
observability	1.1.2	v1.1.2 release exists, no observability-1.1.2.tar.gz asset in it
payments	1.0.0	v1.0.0 release exists, no payments-1.0.0.tar.gz asset in it
pentest	1.1.2	v1.1.2 release exists, no pentest-1.1.2.tar.gz asset in it
pentest-kit	1.0.0	v1.0.0 release exists, no pentest-kit-1.0.0.tar.gz asset in it
plugin-clawde	0.1.0	no release tag v0.1.0 exists
plugin-gauth	0.1.0	no release tag v0.1.0 exists
plugin-llm-gateway	0.1.0	no release tag v0.1.0 exists
plugin-pty	1.0.0	v1.0.0 release exists, no plugin-pty-1.0.0.tar.gz asset in it
plugin-retrieval	0.1.0	no release tag v0.1.0 exists
podcast	1.1.2	v1.1.2 release exists, no podcast-1.1.2.tar.gz asset in it
post	1.1.2	v1.1.2 release exists, no post-1.1.2.tar.gz asset in it
retro-gaming	1.1.2	v1.1.2 release exists, no retro-gaming-1.1.2.tar.gz asset in it
rom-discovery	1.1.2	v1.1.2 release exists, no rom-discovery-1.1.2.tar.gz asset in it
shared-utils	1.0.0	v1.0.0 release exists, no shared-utils-1.0.0.tar.gz asset in it
siem	1.1.2	v1.1.2 release exists, no siem-1.1.2.tar.gz asset in it
sms	1.0.0	v1.0.0 release exists, no sms-1.0.0.tar.gz asset in it
sports	1.1.2	v1.1.2 release exists, no sports-1.1.2.tar.gz asset in it
storage-transform	1.1.2	v1.1.2 release exists, no storage-transform-1.1.2.tar.gz asset in it
tenant-controller	1.1.2	v1.1.2 release exists, no tenant-controller-1.1.2.tar.gz asset in it
tmdb	1.1.2	v1.1.2 release exists, no tmdb-1.1.2.tar.gz asset in it
transactional-email	1.1.0	v1.1.0 release exists, no transactional-email-1.1.0.tar.gz asset in it
warehouse	1.0.0	v1.0.0 release exists, no warehouse-1.0.0.tar.gz asset in it
web3	1.1.2	v1.1.2 release exists, no web3-1.1.2.tar.gz asset in it
workflows	1.1.2	v1.1.2 release exists, no workflows-1.1.2.tar.gz asset in it

Merge order

Should merge after plugins#83 (adds the flat checksum schema field + CHECK-15 validator this PR's data satisfies) and after the 8 entries plugins#81 bumps to 1.0.1 (untouched here). Ran plugins#83's shared/validate-registry.sh locally against this branch's registry.json: 0 errors, 1 pre-existing warning (CHECK-8 sort order, present on origin/main before this change too, unrelated).

Verify

bash shared/validate-registry.sh registry.json   # after #83 merges
git diff --stat origin/main   # touches only registry.json, only checksum lines

[acamarata]

Closing in favour of #81, which now ships all 129 free plugins at 1.0.1 with pipeline-generated checksums (superseding these trust-on-first-use baselines). This PR's body stays as the record of the entries that resolved to 404 before the release: 72 of 129 against the worker's exact <name>-<version>.tar.gz shape (41 @1.1.2, 17 @1.0.0, 8 @0.1.0, 6 others).