# Modrinth Plus Unreleased

## Downloads

Release artifacts are not published yet.

## Highlights

- Connected Library can track public Git-hosted modpack manifests.
- Per-pack auto-update can be enabled after a pack is connected.
- Windows release artifacts are signed with the MrTrust code-signing certificate.
- Gitea Actions are used as the verification runner.

## Security

- Dependency audit: pending runner/toolchain confirmation.
- Secret handling: no tokens are stored by Connected Library v1.
- External network calls: public HTTPS manifest and `.mrpack` downloads.
- Windows trust: MrTrust-installed users can trust Modrinth Plus only when artifacts are signed with the matching MrSphay certificate chain.

## Verification

| Check | Result |
| --- | --- |
| Gitea Actions build | Must pass before release |
| Frontend lint | Covered by Gitea build workflow |
| Rust clippy | Covered by Gitea build workflow |
| MrTrust signing | Required by Gitea build workflow |
| Artifact download | Pending release packaging |

## Notes

This fork is not release-ready until packaging and artifact names are finalized.