Marketplace and extensions

Not every module has to ship inside Cobblr. Extensions are modules that live outside the main app and install into a workspace on demand, so the catalog of what Cobblr can do grows without a new release.

Installing an extension

The marketplace lists available extensions. Your instance's operator installs one onto the instance; from there any workspace can enable its module like a built-in. Extensions run sandboxed, with the same isolation a built-in module has, so installing one can't reach beyond what it declares.

Trust and signing

The marketplace catalog is signed: its index carries an ed25519 signature your instance verifies against a root key baked into the deploy, and the index vouches for author keys. Anything that doesn't verify is labeled unverified, and installing it takes explicit consent rather than one click. A self-hosted instance can also point at its own catalog entirely (COBBLR_EXTENSIONS_URL, see Configuration), which is how a company runs a private marketplace.

Publishing means getting your extension into a catalog: today that's a submission to the public catalog, or adding it to your own.