音のプラグイン倉庫くんAudio Plugin Soko-kun - A warehouse of open-source audio plugins
English

CautionThis platform is an unofficial, free service not affiliated with the developers of plugin formats or DAWs. It does not guarantee the safety of any plugin, so use plugins carefully and at your own risk.This platform is unofficial and does not guarantee the safety of any plugin, so use plugins carefully. What is Audio Plugin Soko-kun?

Security and disclaimer

Automated checks

This platform checks every new release before listing it. It lists only releases that pass the checks.

Formats inspected: VST® 3 CLAP, LV2, Audio Unit

  • Provenance: Every file must have a build provenance attestation. A GitHub Actions workflow verifies its signature. The workflow also confirms that the attestation matches the repository, the release tag, the commit of the tag, and the release workflow recorded for the plugin.
  • Immutable release: The release must be immutable. Files in an immutable release cannot be replaced after it is published.
  • Archive inspection: A GitHub Actions workflow downloads each zip archive and reads the plugin bundles in it without running them. The formats, OS, and architectures shown here come from this inspection. A release that contains VST 2 in any archive, or an archive that cannot be inspected, is not listed.
  • macOS signing and notarization: An archive with macOS bundles is guided only after its bundles are confirmed to be signed with a Developer ID certificate and notarized by Apple.
  • Malware lookup: The SHA-256 digest of each file, as published by GitHub, is looked up in MalwareBazaar, a database of known malware samples. Listed files are looked up again regularly.
  • Changes since the listed release: The changes from the listed release to the new release are checked against rules. A release that matches a rule waits for an administrator to confirm it.
  • Development practice review: Items that the repository files decide, such as pinned actions and release workflows, are checked by rules. Only the items that need reading text, such as install instructions in the README, are judged by an LLM, with facts computed by the catalog. The review does not read the source code. A release with a serious finding waits for an administrator to confirm it.

The review criteria are public on GitHub: https://github.com/AllegroMoltoV/audio-plugin-soko-kun/blob/main/docs/design/review-criteria.md

Releases that have not passed the checks are not shown. Until a new release passes, the previously listed release stays listed.

A file reported as malicious suspends the plugin. An administrator can also suspend a release.

Suspended releases are announced on the notices page https://audio-soko-kun.allegromoltov.jp/notices with the version, the SHA-256 of each file, and the period they were listed here. The plugin page also shows a warning.

Limits of the checks

The malware lookup detects only threats already known to MalwareBazaar. New or targeted malware may not be detected, so use plugins carefully even when nothing is detected.

A Developer ID signature and notarization show who signed a macOS bundle and that Apple scanned it. They are not evidence that the plugin is safe.

The archive inspection identifies formats from the structure of the bundles and the functions they export. It cannot tell whether a plugin that implements the VST 3 interface was built with the VST 3 SDK.

The digest identifies the file that GitHub served when it was recorded. Compare the SHA-256 of the file you download with the value shown here.

Disclaimer

This platform is provided as is, without warranty of any kind, so install plugins at your own risk. The authors of each plugin are responsible for their software.