streamer45 · streamer45 · Jan 31, 2026 · Jan 31, 2026
diff --git a/apps/skit/src/marketplace.rs b/apps/skit/src/marketplace.rs
@@ -264,6 +264,8 @@ pub struct ModelSpec {
     pub source: ModelSource,
     pub expected_size_bytes: Option<u64>,
     pub sha256: Option<String>,
+    #[serde(default)]
+    pub file_checksums: HashMap<String, String>,
     pub license: Option<String>,
     pub license_url: Option<String>,
     #[serde(default)]

diff --git a/apps/skit/src/marketplace_installer.rs b/apps/skit/src/marketplace_installer.rs
@@ -1291,8 +1291,6 @@ impl PluginInstaller {
                         .into());
                     }
                     let revision = revision.as_deref().unwrap_or("main");
-                    let expected_sha256 =
-                        if files.len() == 1 { model.sha256.as_deref() } else { None };
                     for file in files {
                         if cancel.is_cancelled() {
                             return Err(InstallError::Cancelled);
@@ -1301,6 +1299,11 @@ impl PluginInstaller {
                         if !is_safe_relative_path(file_path) {
                             return Err(anyhow!("Invalid model file path '{file}'").into());
                         }
+                        let expected_sha256 = model
+                            .file_checksums
+                            .get(file.as_str())
+                            .map(String::as_str)
+                            .or(if files.len() == 1 { model.sha256.as_deref() } else { None });
                         let target_path = self.models_dir.join(file_path);
                         let display_name = file.as_str();
                         let url = huggingface_model_url(repo_id, revision, file)?;
@@ -1970,6 +1973,7 @@ fn now_ms() -> u128 {
 mod tests {
     use super::*;
     use anyhow::{anyhow, bail, Context, Result};
+    use std::collections::HashMap;
     use std::sync::Arc;
 
     use crate::plugins::UnifiedPluginManager;
@@ -2160,6 +2164,7 @@ mod tests {
             source: crate::marketplace::ModelSource::Url { url: url.clone() },
             expected_size_bytes: Some(payload.len() as u64),
             sha256: Some(hash),
+            file_checksums: HashMap::new(),
             license: None,
             license_url: None,
             gated: false,
@@ -2256,6 +2261,7 @@ mod tests {
             source: crate::marketplace::ModelSource::Url { url: url.clone() },
             expected_size_bytes: Some(payload.len() as u64),
             sha256: Some(hash),
+            file_checksums: HashMap::new(),
             license: None,
             license_url: None,
             gated: false,
@@ -2319,6 +2325,7 @@ mod tests {
             },
             expected_size_bytes: None,
             sha256: None,
+            file_checksums: HashMap::new(),
             license: None,
             license_url: None,
             gated: true,

diff --git a/dist/registry/plugins/helsinki/0.1.0/manifest.json b/dist/registry/plugins/helsinki/0.1.0/manifest.json
@@ -24,9 +24,10 @@
       "files": [
         "opus-mt-en-es.tar.bz2"
       ],
-      "expected_size_bytes": 284844308,
+      "expected_size_bytes": 297199216,
       "license": "Apache-2.0",
-      "license_url": "https://huggingface.co/Helsinki-NLP/opus-mt-en-es"
+      "license_url": "https://huggingface.co/Helsinki-NLP/opus-mt-en-es",
+      "sha256": "6624ec0babce458c0771f493460e62f7e7dc6d4d832e56dbde1621444d4b37cf"
     },
     {
       "id": "opus-mt-es-en",
@@ -38,9 +39,10 @@
       "files": [
         "opus-mt-es-en.tar.bz2"
       ],
-      "expected_size_bytes": 285443600,
+      "expected_size_bytes": 296814376,
       "license": "Apache-2.0",
-      "license_url": "https://huggingface.co/Helsinki-NLP/opus-mt-es-en"
+      "license_url": "https://huggingface.co/Helsinki-NLP/opus-mt-es-en",
+      "sha256": "01a0ddd203b3343d02c013539d4d8f0dfcd747585c9b26f0c3f90f7a11d7cde9"
     }
   ]
 }
diff --git a/dist/registry/plugins/matcha/0.1.0/manifest.json b/dist/registry/plugins/matcha/0.1.0/manifest.json
@@ -26,6 +26,10 @@
         "matcha-icefall-en_US-ljspeech/vocos-22khz-univ.onnx"
       ],
       "expected_size_bytes": 130630855,
+      "file_checksums": {
+        "matcha-icefall-en_US-ljspeech.tar.bz2": "f7862f5d93b956561ee7aca86bf33504f47726c1d5a559066f3cef8fab6c3e23",
+        "matcha-icefall-en_US-ljspeech/vocos-22khz-univ.onnx": "0574a135aa1db2de6e181050db2ec528496cacd4a4701fc5d7faf9f9804c0081"
+      },
       "license": "CC-BY-4.0",
       "license_url": "https://keithito.com/LJ-Speech-Dataset/"
     }

diff --git a/dist/registry/plugins/nllb/0.1.0/manifest.json b/dist/registry/plugins/nllb/0.1.0/manifest.json
@@ -26,7 +26,8 @@
       ],
       "expected_size_bytes": 1135260128,
       "license": "CC-BY-NC-4.0",
-      "license_url": "https://huggingface.co/facebook/nllb-200-distilled-600M"
+      "license_url": "https://huggingface.co/facebook/nllb-200-distilled-600M",
+      "sha256": "6c95a9bc42239a189c71d32aeb66b3108a4fef97d194e3360f3a749671a05c35"
     }
   ]
 }
diff --git a/docs/public/registry/plugins/helsinki/0.1.0/manifest.json b/docs/public/registry/plugins/helsinki/0.1.0/manifest.json
@@ -24,9 +24,10 @@
       "files": [
         "opus-mt-en-es.tar.bz2"
       ],
-      "expected_size_bytes": 284844308,
+      "expected_size_bytes": 297199216,
       "license": "Apache-2.0",
-      "license_url": "https://huggingface.co/Helsinki-NLP/opus-mt-en-es"
+      "license_url": "https://huggingface.co/Helsinki-NLP/opus-mt-en-es",
+      "sha256": "6624ec0babce458c0771f493460e62f7e7dc6d4d832e56dbde1621444d4b37cf"
     },
     {
       "id": "opus-mt-es-en",
@@ -38,9 +39,10 @@
       "files": [
         "opus-mt-es-en.tar.bz2"
       ],
-      "expected_size_bytes": 285443600,
+      "expected_size_bytes": 296814376,
       "license": "Apache-2.0",
-      "license_url": "https://huggingface.co/Helsinki-NLP/opus-mt-es-en"
+      "license_url": "https://huggingface.co/Helsinki-NLP/opus-mt-es-en",
+      "sha256": "01a0ddd203b3343d02c013539d4d8f0dfcd747585c9b26f0c3f90f7a11d7cde9"
     }
   ]
 }
diff --git a/docs/public/registry/plugins/matcha/0.1.0/manifest.json b/docs/public/registry/plugins/matcha/0.1.0/manifest.json
@@ -26,6 +26,10 @@
         "matcha-icefall-en_US-ljspeech/vocos-22khz-univ.onnx"
       ],
       "expected_size_bytes": 130630855,
+      "file_checksums": {
+        "matcha-icefall-en_US-ljspeech.tar.bz2": "f7862f5d93b956561ee7aca86bf33504f47726c1d5a559066f3cef8fab6c3e23",
+        "matcha-icefall-en_US-ljspeech/vocos-22khz-univ.onnx": "0574a135aa1db2de6e181050db2ec528496cacd4a4701fc5d7faf9f9804c0081"
+      },
       "license": "CC-BY-4.0",
       "license_url": "https://keithito.com/LJ-Speech-Dataset/"
     }

diff --git a/docs/public/registry/plugins/nllb/0.1.0/manifest.json b/docs/public/registry/plugins/nllb/0.1.0/manifest.json
@@ -26,7 +26,8 @@
       ],
       "expected_size_bytes": 1135260128,
       "license": "CC-BY-NC-4.0",
-      "license_url": "https://huggingface.co/facebook/nllb-200-distilled-600M"
+      "license_url": "https://huggingface.co/facebook/nllb-200-distilled-600M",
+      "sha256": "6c95a9bc42239a189c71d32aeb66b3108a4fef97d194e3360f3a749671a05c35"
     }
   ]
 }
diff --git a/marketplace/official-plugins.json b/marketplace/official-plugins.json
@@ -21,9 +21,10 @@
           "files": [
             "opus-mt-en-es.tar.bz2"
           ],
-          "expected_size_bytes": 284844308,
+          "expected_size_bytes": 297199216,
           "license": "Apache-2.0",
-          "license_url": "https://huggingface.co/Helsinki-NLP/opus-mt-en-es"
+          "license_url": "https://huggingface.co/Helsinki-NLP/opus-mt-en-es",
+          "sha256": "6624ec0babce458c0771f493460e62f7e7dc6d4d832e56dbde1621444d4b37cf"
         },
         {
           "id": "opus-mt-es-en",
@@ -35,9 +36,10 @@
           "files": [
             "opus-mt-es-en.tar.bz2"
           ],
-          "expected_size_bytes": 285443600,
+          "expected_size_bytes": 296814376,
           "license": "Apache-2.0",
-          "license_url": "https://huggingface.co/Helsinki-NLP/opus-mt-es-en"
+          "license_url": "https://huggingface.co/Helsinki-NLP/opus-mt-es-en",
+          "sha256": "01a0ddd203b3343d02c013539d4d8f0dfcd747585c9b26f0c3f90f7a11d7cde9"
         }
       ]
     },
@@ -92,6 +94,10 @@
             "matcha-icefall-en_US-ljspeech/vocos-22khz-univ.onnx"
           ],
           "expected_size_bytes": 130630855,
+          "file_checksums": {
+            "matcha-icefall-en_US-ljspeech.tar.bz2": "f7862f5d93b956561ee7aca86bf33504f47726c1d5a559066f3cef8fab6c3e23",
+            "matcha-icefall-en_US-ljspeech/vocos-22khz-univ.onnx": "0574a135aa1db2de6e181050db2ec528496cacd4a4701fc5d7faf9f9804c0081"
+          },
           "license": "CC-BY-4.0",
           "license_url": "https://keithito.com/LJ-Speech-Dataset/"
         }
@@ -120,7 +126,8 @@
           ],
           "expected_size_bytes": 1135260128,
           "license": "CC-BY-NC-4.0",
-          "license_url": "https://huggingface.co/facebook/nllb-200-distilled-600M"
+          "license_url": "https://huggingface.co/facebook/nllb-200-distilled-600M",
+          "sha256": "6c95a9bc42239a189c71d32aeb66b3108a4fef97d194e3360f3a749671a05c35"
         }
       ]
     },

diff --git a/plugins/native/helsinki/plugin.yml b/plugins/native/helsinki/plugin.yml
@@ -16,9 +16,10 @@ models:
   revision: main
   files:
   - opus-mt-en-es.tar.bz2
-  expected_size_bytes: 284844308
+  expected_size_bytes: 297199216
   license: Apache-2.0
   license_url: https://huggingface.co/Helsinki-NLP/opus-mt-en-es
+  sha256: 6624ec0babce458c0771f493460e62f7e7dc6d4d832e56dbde1621444d4b37cf
 - id: opus-mt-es-en
   name: OPUS-MT es-en
   default: false
@@ -27,6 +28,7 @@ models:
   revision: main
   files:
   - opus-mt-es-en.tar.bz2
-  expected_size_bytes: 285443600
+  expected_size_bytes: 296814376
   license: Apache-2.0
   license_url: https://huggingface.co/Helsinki-NLP/opus-mt-es-en
+  sha256: 01a0ddd203b3343d02c013539d4d8f0dfcd747585c9b26f0c3f90f7a11d7cde9
diff --git a/plugins/native/matcha/plugin.yml b/plugins/native/matcha/plugin.yml
@@ -18,5 +18,8 @@ models:
   - matcha-icefall-en_US-ljspeech.tar.bz2
   - matcha-icefall-en_US-ljspeech/vocos-22khz-univ.onnx
   expected_size_bytes: 130630855
+  file_checksums:
+    matcha-icefall-en_US-ljspeech.tar.bz2: f7862f5d93b956561ee7aca86bf33504f47726c1d5a559066f3cef8fab6c3e23
+    matcha-icefall-en_US-ljspeech/vocos-22khz-univ.onnx: 0574a135aa1db2de6e181050db2ec528496cacd4a4701fc5d7faf9f9804c0081
   license: CC-BY-4.0
   license_url: https://keithito.com/LJ-Speech-Dataset/
diff --git a/plugins/native/nllb/plugin.yml b/plugins/native/nllb/plugin.yml
@@ -19,3 +19,4 @@ models:
   expected_size_bytes: 1135260128
   license: CC-BY-NC-4.0
   license_url: https://huggingface.co/facebook/nllb-200-distilled-600M
+  sha256: 6c95a9bc42239a189c71d32aeb66b3108a4fef97d194e3360f3a749671a05c35
diff --git a/ui/src/types/marketplace.ts b/ui/src/types/marketplace.ts
@@ -59,6 +59,7 @@ export type ModelSpec = ModelSource & {
   default?: boolean;
   expected_size_bytes?: number | null;
   sha256?: string | null;
+  file_checksums?: Record<string, string>;
   license?: string | null;
   license_url?: string | null;
   gated?: boolean;

diff --git a/ui/src/views/PluginsView.styles.ts b/ui/src/views/PluginsView.styles.ts
@@ -335,19 +335,20 @@ export const StepList = styled.div`
 
 export const StepRow = styled.div`
   display: flex;
-  flex-direction: column;
-  gap: 4px;
+  align-items: center;
+  gap: 8px;
   padding: 8px 10px;
   border-radius: 8px;
   border: 1px solid var(--sk-border);
   background: var(--sk-panel-bg);
 `;
 
-export const StepHeader = styled.div`
+export const StepContent = styled.div`
   display: flex;
-  align-items: center;
-  justify-content: space-between;
-  gap: 8px;
+  flex-direction: column;
+  gap: 4px;
+  flex: 1;
+  min-width: 0;
 `;
 
 export const StepName = styled.div`
@@ -357,6 +358,9 @@ export const StepName = styled.div`
 `;
 
 export const StepStatus = styled.div<{ $status: string }>`
+  display: flex;
+  align-items: center;
+  gap: 4px;
   font-size: 11px;
   font-weight: 600;
   color: ${(props) => {
@@ -429,3 +433,31 @@ export const ModelMeta = styled.span`
   font-size: 11px;
   color: var(--sk-text-muted);
 `;
+
+export const LicenseLink = styled.a`
+  font-size: inherit;
+  color: var(--sk-primary);
+  text-decoration: none;
+
+  &:hover {
+    text-decoration: underline;
+  }
+`;
+
+export const StepSpinner = styled.span`
+  display: inline-block;
+  width: 12px;
+  height: 12px;
+  border: 2px solid var(--sk-border);
+  border-top-color: var(--sk-primary);
+  border-radius: 50%;
+  flex-shrink: 0;
+
+  @keyframes step-spin {
+    to {
+      transform: rotate(360deg);
+    }
+  }
+
+  animation: step-spin 0.8s linear infinite;
+`;
diff --git a/ui/src/views/plugins/MarketplaceJobPanel.tsx b/ui/src/views/plugins/MarketplaceJobPanel.tsx
@@ -13,12 +13,13 @@ import {
   Row,
   Section,
   SectionTitle,
+  StepContent,
   StepError,
-  StepHeader,
   StepList,
   StepMeta,
   StepName,
   StepRow,
+  StepSpinner,
   StepStatus,
   Subtle,
 } from '../PluginsView.styles';
@@ -58,12 +59,15 @@ export const MarketplaceJobPanel: React.FC<MarketplaceJobPanelProps> = ({
               const progress = formatStepProgress(step);
               return (
                 <StepRow key={step.name}>
-                  <StepHeader>
+                  <StepContent>
                     <StepName>{formatStepName(step.name)}</StepName>
-                    <StepStatus $status={step.status}>{step.status}</StepStatus>
-                  </StepHeader>
-                  {progress && <StepMeta>{progress}</StepMeta>}
-                  {step.error && <StepError>{step.error}</StepError>}
+                    {progress && <StepMeta>{progress}</StepMeta>}
+                    {step.error && <StepError>{step.error}</StepError>}
+                  </StepContent>
+                  <StepStatus $status={step.status}>
+                    {step.status}
+                    {step.status === 'running' && <StepSpinner />}
+                  </StepStatus>
                 </StepRow>
               );
             })}

diff --git a/ui/src/views/plugins/MarketplaceModelsSection.tsx b/ui/src/views/plugins/MarketplaceModelsSection.tsx
@@ -8,6 +8,7 @@ import { CheckboxWithLabel } from '@/components/ui/Checkbox';
 import type { MarketplacePluginDetails } from '@/types/marketplace';
 
 import {
+  LicenseLink,
   ModelMeta,
   ModelName,
   ModelRow,
@@ -81,7 +82,17 @@ const MarketplaceModelsSelection: React.FC<{
             />
             <ModelName>{displayName}</ModelName>
             <ModelMeta>{sizeLabel}</ModelMeta>
-            {model.license && <ModelMeta>{model.license}</ModelMeta>}
+            {(model.license || model.license_url) && (
+              <ModelMeta>
+                {model.license_url ? (
+                  <LicenseLink href={model.license_url} target="_blank" rel="noopener noreferrer">
+                    {model.license || model.license_url}
+                  </LicenseLink>
+                ) : (
+                  model.license
+                )}
+              </ModelMeta>
+            )}
             <ModelMeta>
               {fileCount} file{fileCount === 1 ? '' : 's'}
             </ModelMeta>