The current catalogue state could not be checked.
Packages
Packages are curated, versioned compositions of existing plugins. They contain no files of their own and refer to the signed plugin versions.
Official means: published by JAO itself and signed with a registered JAO signing key. Community or external content does not appear here.
No packages have been published yet. Packages appear here only once their plugin versions are actually published.
What Nexus checked, and what it did not
Checked at publication
- The Ed25519 signature matches the exact package bytes and a registered JAO signing key that was active at publication.
- The SHA-256 hash of the stored file matches the signed value.
- Package structure and manifest follow the documented format (allowed paths, size limits, no encrypted entries).
- Publication was explicitly confirmed by the Official Publisher Owner.
Not checked
- No malware or code review and no security guarantee. A signature means authentic and unmodified, not harmless.
Forge check (local)
Before installing, Forge itself re-checks hash and signature against a locally trusted key, plus compatibility and dependencies. It works in a staging area, shows a preview and writes only after your explicit confirmation. A download never changes a project directly. The website awards no "Forge checked" seal; that check happens locally in Forge.
Entitlement
A signature says a file is authentic. An entitlement says your account may obtain it. The two are separate. Even free plugins are only fetched after you explicitly enable them. Enabling installs nothing; installation is a deliberate action in Forge.