Add Signet plugin — local-first cryptographic signing for agent workflows

[willamhou]

Signet Dify Plugin

Cryptographic action receipts for Dify agent workflows. No API key, no SaaS, runs entirely local.

Tools

Tool	Description
Sign Action	Ed25519 sign any tool call, append to hash-chained audit log
Verify Receipt	Offline signature verification
Audit Query	Query local audit trail by time/tool

Setup

No API keys or accounts needed. Auto-creates Ed25519 identity on first use.

Why local-first

• Signing keys never leave your infrastructure
• Audit logs stored locally, verifiable offline
• Supports SOC 2, ISO 27001, EU AI Act compliance controls

Links

• Plugin source: https://github.com/Prismer-AI/dify-plugin-signet
• Signet: https://github.com/Prismer-AI/signet
• PyPI: signet-auth
• Compliance: docs/COMPLIANCE.md

[crazywoola]

❌ Request Changes

Decision: Request changes

Failed Checks

Check	Status	Detail
Dependency install	❌ Fail	Command failed (1): /var/folders/c5/ssq8b54n0rj6rbmghy7_2xdm0000gn/T/pr-review-direct-hdzcflbk/.venv/bin/pip install -r /var/folders/c5/ssq8b54n0rj6rbmghy7_2xdm0000gn/T/pr-review-direct-hdzcflbk/unpacked_plugin/requirements.txt ERROR:root:code for hash blake2…
dify_plugin version	❌ Fail	dify_plugin must be installed and >= 0.5.0, but it was not found.
Install test	❌ Fail	Command failed (1): /var/folders/c5/ssq8b54n0rj6rbmghy7_2xdm0000gn/T/pr-review-direct-hdzcflbk/.venv/bin/python /var/folders/c5/ssq8b54n0rj6rbmghy7_2xdm0000gn/T/pr-review-direct-hdzcflbk/toolkit/validator/test-plugin-install.py -d /var/folders/c5/ssq8b54n0rj6…
Packaging test	❌ Fail	Command failed (1): /var/folders/c5/ssq8b54n0rj6rbmghy7_2xdm0000gn/T/pr-review-direct-hdzcflbk/.venv/bin/python /var/folders/c5/ssq8b54n0rj6rbmghy7_2xdm0000gn/T/pr-review-direct-hdzcflbk/toolkit/uploader/upload-package.py -d /var/folders/c5/ssq8b54n0rj6rbmghy…

Full Check Results

Check	Status	Detail
PR content language	✅ Pass	PR title/body CJK ratio=0.0% (zh=0, en=716, ignored_zh=0, allowed_zh<=0)
Project structure	✅ Pass	All expected files present: manifest.yaml, README.md, PRIVACY.md. _assets/: yes.
Manifest author	✅ Pass	author is valid.
Icon validation	✅ Pass	icon exists: _assets/icon.svg
Version check	✅ Pass	version 0.0.1 is available.
README language	✅ Pass	README.md CJK ratio=0.0% (zh=0, en=1020, allowed_zh<=0)
PRIVACY.md	✅ Pass	PRIVACY.md exists and is non-empty.
Dependency install	❌ Fail	Command failed (1): /var/folders/c5/ssq8b54n0rj6rbmghy7_2xdm0000gn/T/pr-review-direct-hdzcflbk/.venv/bin/pip install -r /var/folders/c5/ssq8b54n0rj6rbmghy7_2xdm0000gn/T/pr-review-direct-hdzcflbk/unpacked_plugin/requirements.txt ERROR:root:code for hash blake2…
dify_plugin version	❌ Fail	dify_plugin must be installed and >= 0.5.0, but it was not found.
Install test	❌ Fail	Command failed (1): /var/folders/c5/ssq8b54n0rj6rbmghy7_2xdm0000gn/T/pr-review-direct-hdzcflbk/.venv/bin/python /var/folders/c5/ssq8b54n0rj6rbmghy7_2xdm0000gn/T/pr-review-direct-hdzcflbk/toolkit/validator/test-plugin-install.py -d /var/folders/c5/ssq8b54n0rj6…
Packaging test	❌ Fail	Command failed (1): /var/folders/c5/ssq8b54n0rj6rbmghy7_2xdm0000gn/T/pr-review-direct-hdzcflbk/.venv/bin/python /var/folders/c5/ssq8b54n0rj6rbmghy7_2xdm0000gn/T/pr-review-direct-hdzcflbk/toolkit/uploader/upload-package.py -d /var/folders/c5/ssq8b54n0rj6rbmghy…

Required Fixes

• Dependency install: Command failed (1): /var/folders/c5/ssq8b54n0rj6rbmghy7_2xdm0000gn/T/pr-review-direct-hdzcflbk/.venv/bin/pip install -r /var/folders/c5/ssq8b54n0rj6rbmghy7_2xdm0000gn/T/pr-review-direct-hdzcflbk/unpacked_plugin/requirements.txt
  ERROR:root:code for hash blake2b was not found.
  Traceback (most recent call last):
  File "/Users/minibanana/.pyenv/versions/3.12.7/lib/python3.12/hashlib.py", line 245, in
  globals()[__func_name] = __get_hash(__func_name)
  ^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/minibanana/.pyenv/versions/3.12.7/lib/python3.12/hashlib.py", line 129, in __get_openssl_constructor
  return __get_builtin_constructor(name)
  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/minibanana/.pyenv/versions/3.12.7/lib/python3.12/hashlib.py", line 123, in __get_builtin_constructor
  raise ValueError('unsupported hash type ' + name)
  ValueError: unsupported hash type blake2b
  ERROR:root:code for hash blake2s was not found.
  Traceback (most recent call last):
  File "/Users/minibanana/.pyenv/versions/3.12.7/lib/python3.12/hashlib.py", line 245, in
  globals()[__func_name] = __get_hash(__func_name)
  ^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/minibanana/.pyenv/versions/3.12.7/lib/python3.12/hashlib.py", line 129, in __get_openssl_constructor
  return __get_builtin_constructor(name)
  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/minibanana/.pyenv/versions/3.12.7/lib/python3.12/hashlib.py", line 123, in __get_builtin_constructor
  raise ValueError('unsupported hash type ' + name)
  ValueError: unsupported hash type blake2s
  ERROR: Could not find a version that satisfies the requirement dify-plugin-sdk>=0.1 (from versions: none)
  ERROR: No matching distribution found for dify-plugin-sdk>=0.1
• dify_plugin version: dify_plugin must be installed and >= 0.5.0, but it was not found.
• Install test: Command failed (1): /var/folders/c5/ssq8b54n0rj6rbmghy7_2xdm0000gn/T/pr-review-direct-hdzcflbk/.venv/bin/python /var/folders/c5/ssq8b54n0rj6rbmghy7_2xdm0000gn/T/pr-review-direct-hdzcflbk/toolkit/validator/test-plugin-install.py -d /var/folders/c5/ssq8b54n0rj6rbmghy7_2xdm0000gn/T/pr-review-direct-hdzcflbk/unpacked_plugin
  ERROR:root:code for hash blake2b was not found.
  Traceback (most recent call last):
  File "/Users/minibanana/.pyenv/versions/3.12.7/lib/python3.12/hashlib.py", line 245, in
  globals()[__func_name] = __get_hash(__func_name)
  ^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/minibanana/.pyenv/versions/3.12.7/lib/python3.12/hashlib.py", line 129, in __get_openssl_constructor
  return __get_builtin_constructor(name)
  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/minibanana/.pyenv/versions/3.12.7/lib/python3.12/hashlib.py", line 123, in __get_builtin_constructor
  raise ValueError('unsupported hash type ' + name)
  ValueError: unsupported hash type blake2b
  ERROR:root:code for hash blake2s was not found.
  Traceback (most recent call last):
  File "/Users/minibanana/.pyenv/versions/3.12.7/lib/python3.12/hashlib.py", line 245, in
  globals()[__func_name] = __get_hash(__func_name)
  ^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/minibanana/.pyenv/versions/3.12.7/lib/python3.12/hashlib.py", line 129, in __get_openssl_constructor
  return __get_builtin_constructor(name)
  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/minibanana/.pyenv/versions/3.12.7/lib/python3.12/hashlib.py", line 123, in __get_builtin_constructor
  raise ValueError('unsupported hash type ' + name)
  ValueError: unsupported hash type blake2s
• Packaging test: Command failed (1): /var/folders/c5/ssq8b54n0rj6rbmghy7_2xdm0000gn/T/pr-review-direct-hdzcflbk/.venv/bin/python /var/folders/c5/ssq8b54n0rj6rbmghy7_2xdm0000gn/T/pr-review-direct-hdzcflbk/toolkit/uploader/upload-package.py -d /var/folders/c5/ssq8b54n0rj6rbmghy7_2xdm0000gn/T/pr-review-direct-hdzcflbk/unpacked_plugin -t placeholder --plugin-daemon-path /var/folders/c5/ssq8b54n0rj6rbmghy7_2xdm0000gn/T/pr-review-direct-hdzcflbk/dify-plugin-darwin-arm64 -u https://marketplace.dify.ai -f --test
  ERROR:root:code for hash blake2b was not found.
  Traceback (most recent call last):
  File "/Users/minibanana/.pyenv/versions/3.12.7/lib/python3.12/hashlib.py", line 245, in
  globals()[__func_name] = __get_hash(__func_name)
  ^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/minibanana/.pyenv/versions/3.12.7/lib/python3.12/hashlib.py", line 129, in __get_openssl_constructor
  return __get_builtin_constructor(name)
  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/minibanana/.pyenv/versions/3.12.7/lib/python3.12/hashlib.py", line 123, in __get_builtin_constructor
  raise ValueError('unsupported hash type ' + name)
  ValueError: unsupported hash type blake2b
  ERROR:root:code for hash blake2s was not found.
  Traceback (most recent call last):
  File "/Users/minibanana/.pyenv/versions/3.12.7/lib/python3.12/hashlib.py", line 245, in
  globals()[__func_name] = __get_hash(__func_name)
  ^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/minibanana/.pyenv/versions/3.12.7/lib/python3.12/hashlib.py", line 129, in __get_openssl_constructor
  return __get_builtin_constructor(name)
  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/minibanana/.pyenv/versions/3.12.7/lib/python3.12/hashlib.py", line 123, in __get_builtin_constructor
  raise ValueError('unsupported hash type ' + name)
  ValueError: unsupported hash type blake2s
  Traceback (most recent call last):
  File "/var/folders/c5/ssq8b54n0rj6rbmghy7_2xdm0000gn/T/pr-review-direct-hdzcflbk/toolkit/uploader/upload-package.py", line 135, in
  main()
  File "/var/folders/c5/ssq8b54n0rj6rbmghy7_2xdm0000gn/T/pr-review-direct-hdzcflbk/toolkit/uploader/upload-package.py", line 52, in main
  upload_directory(args.directory, args.token, MARKETPLACE_BASE_URL, args.force, args.changelog)
  File "/var/folders/c5/ssq8b54n0rj6rbmghy7_2xdm0000gn/T/pr-review-direct-hdzcflbk/toolkit/uploader/upload-package.py", line 99, in upload_directory
  raise Exception("Failed to package the directory")
  Exception: Failed to package the directory

Please address these issues and push an update.

[willamhou]

Fixed the dependency issue — updated to dify-plugin>=0.5.0 (was incorrectly using dify-plugin-sdk). Also fixed the entrypoint to use Plugin().run().

The updated difypkg (v0.0.2) should pass the install check now.

[willamhou]

Updated to v0.0.3 with corrected dependencies:

• Replaced signet-0.0.2.difypkg with signet-0.0.3.difypkg
• requirements.txt confirmed: dify-plugin>=0.5.0 (not dify-plugin-sdk)
• main.py uses from dify_plugin import Plugin

The failed checks in the previous review show ValueError: unsupported hash type blake2b from Python's hashlib in the reviewer sandbox — this appears to be a transient CI environment issue (Python 3.12.7 on pyenv) rather than a package problem. The package itself builds and installs cleanly with dify-plugin>=0.5.0.

Source: https://github.com/Prismer-AI/dify-plugin-signet

[crazywoola]

Thank you for your contribution. We need to close this PR for now because the required CI checks are failing.

For security and compatibility reasons, please make sure dify_plugin is installed and updated to version >= 0.9.0. After updating the PR and confirming the checks pass, you are welcome to reopen it or submit a new PR for review.

Thanks again for helping improve the Dify plugin ecosystem.