publisher

​

Fields

​

Example

publisher:
  name: Example Inc.
  signing:
    scheme: ed25519
    signatureFile: signatures/package.sig
    publicKeyFile: signatures/publisher.pub

​

Signing workflow

1. Generate a keypair: vibe keygen -o my-signing
2. Package the app: vibe package vibe.yaml -o myapp.vibeapp
3. Sign the package: vibe sign myapp.vibeapp --key my-signing.key
4. The signing tool adds signatures/package.sig and signatures/publisher.pub to the archive and updates the manifest’s publisher.signing fields

​

Trust store

• If the publisher’s public key is in the trust store → Signed + Trusted (green)
• If valid but not in trust store → Signed + Untrusted (yellow, prompt to trust)
• If signature is invalid or content is tampered → Tampered (red block)