I saw this topic today: https://meta.discourse.org/t/plugin-repository-hijacked/374703
It is nice that this problem is "solved" for this repository. But the real problem still exists. How do you sign, and what is the source for the key to verify the signature with.
So my first stab at that problem would be to make use for the git builtin signing mechanism. Discourse would then need to keep track of the signer of an installed plugin. If that changes it should warn the admin.
This obviously has a lot of holes in it.
Where to get the signer's keys from? Metadata in plugin.rb and about.json. Keyservers are nice... but quite complicated. Or... meta.discourse.org serves as keyserver, so authors should register their public keys.
Only verify the most recent commit? Probably sufficient, can't do much about stolen keys
But if a key is stolen, how to check revocation? If meta serves the key, that problem could be solved.
This is great for the admin ui, but what about the plugin installs in a docker container? Save previously accepted singing keys in shared, and add a verification step to the rebuild. Probably a pre-build check to prevent taking the system down and then rejecting the clone; and then a post checkout check just in case somebody messed with the repo in the meantime?
What about old unsigned repos? Big warning that its content cannot be verified. + yes/no/cancel prompt
Discuss this on our forum.