Package signatures
Protect against tampered, malicious, or unmaintained code by signing packages and checking for signatures.
阅读时间2 分钟最后更新于 10 天前
Package publishers can sign packages, and package consumers can check for those signatures to protect against tampered, malicious, or unmaintained code from entering a project.
Starting with Unity 6.3, the Package Manager checks for digital signatures on all tarball packages used in the Unity ecosystem. Starting with Unity 6.6, this check extends to asset packages exported and imported as local files. Package signatures are part of Unity Core Standards.
The recommended best practice is for all package creators to sign their packages and for all consumers to use only signed packages. Multiple signing methods are available, from visual workflows in the Unity Editor to standalone command-line tools ideal for continuous integration or continuous delivery (CI/CD) pipelines.
Topic | Description |
|---|---|
| Introduction to package signatures | Understand what package signatures are, how the Package Manager displays signature status, and what each status indicator means. |
| Package security settings | Understand how package security settings controls which packages Unity allows you to install, and how to choose a security threshold that matches your project's needs. |
| Methods for signing packages | Get an overview of how package signing works, and learn about the methods you can use to sign packages that you create. |
| Sign UPM packages with the Package Manager window | Pack and sign a package with a visual interface directly in the Unity Editor. |
| Pack and sign a UPM package using Editor command-line arguments | Create a signed tarball from the command line using Unity Editor batch mode. Useful in CI/CD pipelines. |
| Unity Package Manager command-line interface | Learn about the standalone UPM CLI tool and the workflow you can use to pack and sign packages outside of the Unity Editor. Ideal for CI/CD pipelines. |
| Sign packages with the scripting API | Pack and sign a package using the |