Store & verification

Caspian's own catalogue lives at store.getcaspian.app. Extensions listed there are reviewed and signed by Caspian and carry a verified badge in the browser; everything else installs too, without the badge.

What the badge means

Verified by Caspian — the package was reviewed, its manifest and permissions are what the listing says, and every release is signed with Caspian's store key. Caspian checks the signature on install and on update; a package that doesn't match its listing is refused. The badge shows on the extensions page and in the toolbar button's card.

Where an extension can come from

Caspian Extension Store

Reviewed, signed, verified badge, updates from the store.

Chrome Web Store

Installs from the listing with Add to Caspian. Runs unverified: Caspian trusts Chrome's review for what it is, but did not check it.

Sideloaded (.crx, .zip, unpacked)

For development and private tools. Unverified — unless the package ships a Caspian verification file, see below.

Publishing

The store opens for submissions with Caspian 0.1.6. A listing is: your package (a .zip of the extension folder or a .crx), an icon, screenshots, a description, a support address, and the source repository if it is open. Review looks at permissions against what the extension does, at where it sends data, and at the code that runs on pages. Store extensions update through the store: publish a new version and installed copies pick it up.

Until submissions open

Send the package and a short description to hello@getcaspian.app. Early listings get reviewed by hand and go up with the store.

Verification for sideloaded extensions

A package Caspian has reviewed can carry its verification with it, so a copy installed from a file (an enterprise's own distribution, a developer's own site) still shows the badge. It is one file in the package root:

caspian-verification.jsonjson

{
  "id": "abcdefghijklmnopabcdefghijklmnop",
  "version": "1.4.2",
  "sha256": "<sha256 of the package contents, as the store computed it>",
  "issued": "2026-09-14T00:00:00Z",
  "signature": "<Ed25519 signature by Caspian's store key, base64>"
}

Caspian ships the store's public key. On install it hashes the package the same way, checks the signature over id · version · sha256 · issued, and only then shows the badge. Change a byte and the badge goes; the extension still runs, unverified. You cannot create this file yourself — it comes from the store for a reviewed version — but you can ship it with any copy of that version.

Ids and keys

Ids are Chrome's format, 32 letters a–p. A store listing keeps the id of the package's key (the same id the Chrome Web Store would give it), so an extension published on both stores has one id everywhere and chrome.runtime.id is stable. Unpacked folders get an id derived from their path, as in Chrome.

Store API (for tooling)

GET store.getcaspian.app/api/extensions lists the catalogue as JSON; /api/extensions/<id> gives one listing with its versions and package URLs; /verified.json is the signed list Caspian downloads. All three are public and cacheable.

Overview Building extensions API coverage