The public catalog for C2 plugin bundles. Plugin code stays in its author's repository; this repository stores reviewed, immutable catalog entries only.
这是 C2 社区插件的公开目录。插件源码保留在作者自己的仓库中,本仓库只收录经过校验、 固定到不可变提交的目录条目。
Download or clone this repository, then open its marketplace.json from Settings → Features &
Plugins → Marketplace. Automatic remote catalog updates are not enabled in C2 yet.
Every entry points to an exact 40-character Git commit. Installing a bundle is data-only. A bundle that contains a process still requires explicit trust before C2 runs it.
Read CONTRIBUTING.md, add one sorted entry to marketplace.json, and open a pull
request. Run this check before submitting:
node scripts/validate-catalog.mjsCatalog inclusion confirms only that the submitted metadata and bundle contract passed the stated checks. It is not a security, quality, or maintenance endorsement.
CI fetches every exact source commit, verifies the selected plugin.json name and version, and
runs the bundle through the pinned C2 Rust installer's bounded collector and package parser. The
validator revision is explicit in the workflow so a catalog review cannot silently change its
rules.
- one canonical
marketplace.json; - one entry per plugin name, pinned to one released version;
- public, author-owned GitHub repository;
- exact commit SHA and bundle subdirectory;
- no plugin source, mutable download URL, secret, or credential in this repository.
The catalog currently follows C2 Marketplace Standard 1.0.0. Host compatibility, artifact
signatures, yanking, and advisory metadata will be added before this becomes C2's automatic default
update channel.
Catalog metadata and repository tooling are licensed under Apache-2.0. Plugin bundles keep the licenses declared by their own repositories.