Every bundle is signed with your private key. The marketplace and PrusaSlicer check the signature with the public key you registered, so they know the bundle comes from you and was not changed. The private key stays with you. Never paste it anywhere.

Publishing from GitHub Actions signs the bundle for you. You only need the key pair from the first step.

Some of the following commands assume the PrusaSlicer 3 executable is on your PATH as PrusaSlicer.

1. Create a key pair

The marketplace uses RSA keys of 2048 bits or more.

Using the PrusaSlicer CLI:

PrusaSlicer plugin keygen -P private_key.pem -p public_key.pem -k 2048

Using openssl:

openssl genpkey -algorithm RSA -out private_key.pem -pkeyopt rsa_keygen_bits:2048
openssl rsa -pubout -in private_key.pem -out public_key.pem

Keep private_key.pem secret and back it up somewhere safe, such as a password manager. Whoever has it can sign plugins as you, and the marketplace holds only the public key, so a lost key cannot be recovered. If it leaks, revoke it.

2. Register the public key

Open Signing keys in the author console and paste the contents of public_key.pem, or upload the file. You can register several keys, for example one per machine.

3. Sign a bundle

In the folder with your bundle files, write the list of checksums into manifest.txt and sign it:

Using the PrusaSlicer CLI (recommended):

PrusaSlicer plugin sign -P /path/to/private_key.pem your-bundle-folder

Using openssl:

cd your-bundle-folder
shasum -a256 $(find * -type f ! -path manifest.txt ! -path manifest.sig) | sort -k2 > manifest.txt
openssl dgst -sha256 -sign /path/to/private_key.pem -out manifest.sig manifest.txt
zip -r ../[email protected] *

manifest.sig covers manifest.txt, and manifest.txt covers every other file, so one signature protects the whole bundle. Only the manifest.txt and manifest.sig at the root are left out: a file of that name in a subfolder is part of the plugin and must be listed.

Expire or revoke a key

• Expire a key you are retiring. New uploads signed with it are refused, versions already published keep installing.
• Revoke a key only if it leaked. Versions signed with it no longer verify or install. Upload a new key and publish fresh versions.