Skip to content

Fix plugin verification docs: replace removed CLI commands #1501

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
fmartingr wants to merge 2 commits into
base: master
Choose a base branch
from
+8 −12
Open

Fix plugin verification docs: replace removed CLI commands #1501

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ad7306c
Fix plugin verification docs: replace removed CLI commands with confi…
fmartingr Apr 14, 2026
0fccd5e
Merge branch 'master' into fix/plugin-verification
fmartingr Apr 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 8 additions & 12 deletions site/content/integrate/plugins/using-and-managing-plugins.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -195,21 +195,17 @@ This command will generate `com.mattermost.demo-plugin-0.1.0.tar.gz.sig`, which

## Plugin verification

Mattermost server will verify plugin signatures downloaded from the Marketplace. To add custom public keys, run the following command on the Mattermost server:
Mattermost server will verify plugin signatures downloaded from the Marketplace. Plugins are verified against a hard-coded Mattermost public key, as well as any additional public keys configured on the server.

`mattermost plugin add key my-pub-key`
To add custom public keys for plugin signature verification, add the key file names to the `PluginSettings.SignaturePublicKeyFiles` setting in your `config.json`:
Comment on lines +198 to +200
Copy link

Copilot AI Apr 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This section describes verification keys as a “hard-coded Mattermost public key”, but earlier in the same document the terminology is “default certificate” / “public key certificate” (see around lines 105-107). To avoid confusion about whether this is a raw public key vs a certificate, align the wording here with the earlier terminology (or update both to use a single, consistent term).

Copilot uses AI. Check for mistakes.

Multiple public keys can be added to the Mattermost server:

`mattermost plugin add key my-pk-file1 my-pk-file2`

To list the names of all public keys installed on your Mattermost server, use:

`mattermost plugin keys`

To delete public key(s) from your Mattermost server, use:
```json
"PluginSettings": {
"SignaturePublicKeyFiles": ["my-pub-key-1", "my-pub-key-2"]
Comment on lines +203 to +204
Copy link

Copilot AI Apr 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The JSON example is a fragment (missing the outer {}), which makes it ambiguous where it belongs in config.json and can be confusing when copying/pasting. Consider showing a complete (or clearly elided) JSON object that includes the top-level braces and PluginSettings nesting, consistent with other config snippets in this docs repo.

Suggested change
"PluginSettings": {
"SignaturePublicKeyFiles": ["my-pub-key-1", "my-pub-key-2"]
{
"PluginSettings": {
"SignaturePublicKeyFiles": ["my-pub-key-1", "my-pub-key-2"]
}

Copilot uses AI. Check for mistakes.
}
```

`mattermost plugin delete key my-pk-file1 my-pk-file2`
The key files themselves must be stored in the Mattermost server's config directory.

### Implementation

Expand Down
Loading