Check O6 · execution surface family · severity HIGH · automatic · one of the 17 Open VSX checks
Maps to OWASP LLM03 Open VSX signs the packages it serves; a version with no signature is an evidence gap — integrity cannot be checked, not proof of tampering.
The question this check asks: does the latest version's record name Open VSX's signature file? Open VSX signs the packages it serves with its own key, and the record lists the signature beside the package (files.signature).
A version with no signature is one whose integrity cannot be checked against the registry that serves it. It is rare, which is exactly why it is worth a line when it happens.
A record with no signature file is ovsx-unsigned: MEDIUM and 4 points on an established listing, HIGH and 10 points on one under 90 days old (the default weights; the scoring table has no row of its own for the Open VSX checks yet).
All 100 of the most-downloaded extensions measured on 1 November 2026 carry a signature; O6 fired on none.
What a signature means. It says Open VSX signed what it serves, not who wrote the code or what it does: a campaign package is signed like any other. The signature itself: O6 reads whether the record names a signature file; it does not verify the signature. It also does not read Open VSX's own scan results, which are admin-only.
Scope, the same on every page of this roster: RepoGates does not see git clone, package managers or curl — outside Claude Code with the RepoGates plugin, whose hook refuses a clone or install that names a blocked repository on the command line, before it runs. The hook sees Bash tool calls in that one client and nothing else. Edit and Write are read for one thing only — an API key about to be saved — checked on the machine and never sent; that guard asks, it never denies. Open VSX is the registry VSCodium, Cursor and Windsurf install from. An extension there is assessed on request: through the API (/v1/ovsx/score/{namespace}/{extension}), the MCP server (platform="ovsx") and the preflight, which reads an open-vsx.org address and a codium, vscodium, cursor or windsurf --install-extension line. That line is read against both Open VSX and the VS Code Marketplace, because it cannot show which registry the editor uses; code --install-extension stays the Marketplace's. An extension installed from the editor's own UI, or one that auto-updates, is not a shell line the hook sees; there is no board on Open VSX's pages, and the browser's download gate does not read open-vsx.org. This roster reads what Open VSX publishes about an extension — its record, its version history, its manifest, the package's file list and at most eight agent files inside the package — and the extension's code bundle is not read on this tier. Open VSX's own scan results are admin-only and not published; its review status is evidence, and its silence is never a pass. An extension Open VSX no longer serves is not assessed, never a pass. A PASS means nothing matched on what was read.
curl -s https://open-vsx.org/api/NAMESPACE/EXTENSION | jq '.files | {signature, publicKey}'A record with a signature names it here.
Does a signature mean the package was reviewed? No. It means Open VSX signed the file it serves. A malicious package published to Open VSX is signed in the same way.
Does RepoGates verify the signature? No. O6 reads whether the record names a signature file. Verifying it would mean downloading the package, which this tier never does.
Is this the same as the Marketplace's signature check? It is its twin. V6 reads the Marketplace's own signature asset; O6 reads Open VSX's.
V6 Package signature — the Marketplace twin · O11 Open VSX review status and deprecation — the other thing Open VSX says about a version.
Add RepoGates to Chrome Pricing
Sources for this page: Open VSX's published record format, read on 1 November 2026; the measurement of Open VSX's 100 most-downloaded extensions the same day; the severities from the product's roster, and the default weights of its scoring table; campaign facts as the primary write-ups state them. See also the Open VSX intelligence page.