Marketplaces can offer plugins as zip downloads with an optional sha256 pin that doubles as the version.
What's wrong with this entry?
A marketplace entry can now point at a plugin as an archive: an HTTPS URL for a zip file, with an optional sha256 digest. The digest is checked on every download and also serves as the plugin's version identity, so a changed archive is a changed version. This source type is always available, not gated.
- If the zip contains a single wrapping directory, it is stripped so the plugin's files land at the top level.
- Archives must be served over HTTPS.
HTTPS URL of a zip archive containing the plugin.
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Related
Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.
-
v2.1.242
Cloud session sync for folders that are not git checkouts
Both mention archive