From 16a1d7bfeb76253e973893224c4fa754384f8864 Mon Sep 17 00:00:00 2001 From: Aric Camarata Date: Fri, 11 Sep 2026 14:23:44 -0400 Subject: [PATCH] fix(registry): point ollama at the plugin CDN, not the licence host MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ollama's download_url was https://ping.nself.org/plugins/ollama/download. ping.nself.org is the licence-validation host and that path is licence-gated, so the request answers 401. ollama is a free plugin (tier: free, requires_license: false), so nothing was ever going to authorise it. Found by downloading every free plugin the registry Worker serves and hashing the result: 129 entries, 127 verified against their served checksum, one correct exemption (shared-utils, installable:false, no tarball), and ollama — the only free entry of 128 whose download_url does not point at plugins.nself.org. The artifact itself was fine all along: the tarball field already resolved to the v1.2.1 release asset, which downloads and hashes to exactly the checksum the registry serves. Only the URL the CLI is told to fetch from was wrong. Now matches the pattern every other free plugin uses: https://plugins.nself.org/plugins//tarball --- registry.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/registry.json b/registry.json index 32b4d6d..3029757 100644 --- a/registry.json +++ b/registry.json @@ -1718,7 +1718,7 @@ "license": "Source-Available", "min_nself_version": "1.0.9", "tarball": "https://github.com/nself-org/plugins/releases/download/v1.2.1/ollama-1.2.1.tar.gz", - "download_url": "https://ping.nself.org/plugins/ollama/download", + "download_url": "https://plugins.nself.org/plugins/ollama/tarball", "requires_license": false, "language": "go", "tags": [