Security and limits

Add-ons are a developer preview. Here is what Ledge protects you from today, what it doesn't yet, and what's coming.

What protects you today

  • Every add-on in the Store has been reviewed and merged into the public LedgeAddOns repository.
  • Store builds come from the merged commit, in a job that pull requests can't touch.
  • Ledge checks every downloaded file against the catalogue's hash, and only downloads from LedgeAddOns releases.
  • Ledge validates every package, from the Store or your Mac, before installing it.
  • Ledge asks you to trust each add-on, and names its author, before anything runs.
  • Ledge handles sign-in and keeps credentials in the Keychain. Add-ons get a short-lived token for each request.

What isn't in place yet

  • No sandbox. An add-on runs as a separate process, but with your user account's access. Install only add-ons from developers you trust.
  • Development signatures. Store builds are ad-hoc signed, not signed with a Developer ID or notarised. The hash proves a file is the one in the catalogue, not who made it.
  • Two kinds of add-on. Ledge only runs Spotify Likes, under the spotify-likes ID, and the experimental Notifications add-on, under notifications. Other add-ons are listed in the Store but marked as needing a newer Ledge.
  • No add-on interface. Add-ons can't add their own settings, player buttons or widgets yet.
  • No install counts. An add-on's page shows Installs as “Not available” until a service can count verified installs.
  • No automatic updates. Reinstall from the Store to get a newer version.

What's coming

Roughly in this order:

  1. A registry so any add-on, under its own ID, can be installed, updated and removed on its own.
  2. A lasting connection between Ledge and each add-on, with timeouts, cancellation and clean shutdown, so a stuck or crashing add-on can't hold Ledge up.
  3. Services scoped to each add-on: its own settings and files, and sign-in handled by Ledge without handing over raw tokens.
  4. Player buttons and settings pages that add-ons describe and Ledge draws.
  5. More ledgekit commands, from creating a new add-on to installing it, and Ledge Playground, a separate app for trying add-ons without touching your everyday Ledge.
  6. Widgets and live activities from add-ons.