Updates & update.json

How plugin updates are published, and how the Majic app checks and installs them.

Publishing an update

1. Bump version in majic.json and publish a new GitHub release with the matching tag and the <id>.zip package.
2. In My Plugins, click Propose an update.
3. An admin reviews the code changes and any new permission. The current version stays online in the meantime.
4. Once approved, the new version is served to the app through update.json.

The update.json endpoint

GET /api/plugins/<id>/update.json returns the latest approved version of a plugin. Versions pending review are never served. It returns 404 if the plugin does not exist or is not approved yet.

{
  "*": {
    "version": "1.1.0",
    "download_url": "https://github.com/<author>/<repo>/releases/download/v1.1.0/resource-advisor.zip",
    "sha256": "b53b13a90ed9276cd0277b5fb0556611d1cfb8225442a3c1b0b96c16d69ebcd5",
    "size": 482113,
    "permissions": ["ui", "storage", "notifications"],
    "majic_version": ">=1.0.0",
    "api_version": 1
  }
}

What the app verifies

The site checks a plugin once, during review. The app checks it on every install and update, on the user's machine:

1. Only trust this site. The app always uses /api/plugins/<id>/update.json on Majic's domain, whatever update_url says in the manifest.
2. Verify the SHA-256 of the downloaded zip against sha256. If it differs, the installation is refused: the file may have been replaced on GitHub after the review.
3. Verify the majic.json inside the zip: its id, version and permissions must match update.json exactly.
4. Show the permissions before installing, and ask again if an update adds any. Check majic_version compatibility.