{"version":"2.1.238","anchor":"zip-archive-plugin-entries-can-carry-their-own-fetch-credent","canonical_anchor":"zip-archive-plugin-entries-can-carry-their-own-fetch-credent","heading":"Zip-archive plugin entries can carry their own fetch credentials","tier":"use","area":"Plugins","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.238\/e\/zip-archive-plugin-entries-can-carry-their-own-fetch-credent","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.238","markdown":"### Zip-archive plugin entries can carry their own fetch credentials\n\nPlugin archives can carry their own fetch headers or a helper command instead of inheriting them.\n\n**What**\n\nMarketplace catalog entries and plugin entries declared in settings files both accept `headers` and a `headersHelper` command, so an archive no longer has to inherit authentication from the enclosing marketplace. `-y, --yes` now also consents to the helper command used to fetch an archive, and on updates to a changed install command.\n\n**Details**\n\n- An entry's own auth is bound to its URL and overlaid on the enclosing url-source marketplace's headers only when the archive shares that origin.\n- One resolver now decides archive auth from the marketplace source, the trusted declaration and the settings-entry auth together.\n- `headersHelper` values are validated as printable ASCII and capped at a length the install consent pane can render.\n- A managed-policy refusal reports `entry_helper_disabled_by_policy` or `entry_helper_remote_policy_unconsented`.\n- Trust telemetry gained `hasMarketplaceHeadersHelper` and `hasRepoHeadersHelpers`; a new on-disk cache namespace `pluginAssetCache`, keyed by archive digest, sits alongside.\n\n**Evidence**\n\n`headersHelper must not be longer than the install consent UI can display`, `bound to this URL`, `one whose archive is fetched through a headersHelper command (required when stdin or stdout is not a TTY)`\n\n- Area: Plugins\n- Names: `headers`, `headersHelper`, `--yes`\n- Tier: Use it now\n- Useful: 3\/5\n- Signal: 3\/5"}