New update process for plugin maintainers

[zyedidia]

Hi all,

Thank you to all those who have written and maintain plugins for micro!

I have modified the plugin registration and update process in the plugin channel to make the process more secure for micro users. Plugin release code will now be hosted at the plugin channel repository instead of by individual plugin maintainers. This means if you update your plugin, you will need to open a PR on the plugin channel, which I will review before approving. After reviewing the plugin code you provide as a zip file, I will upload it so that users can access the update. This vastly reduces the amount of trust users must have of plugin maintainers, and won't lead to a security problem if a plugin maintainer is compromised (via hacking, etc..). Please see here for the new instructions for adding/updating plugins in the plugin channel.

You may continue to provide your own releases via your repo.json, and if users decide to fully trust you they can manually list your plugin's repo.json in the pluginrepos option, or host their own custom plugin channel via pluginchannels, or of course just manually install your plugin by downloading it into the ~/.config/micro/plug directory.

In addition, I may not have the time to review every new plugin, but you can still open a PR to the plugin channel. You can consider the list of PRs to be a list of "unofficial" plugins. I will try to quickly approve updates to existing official plugins.

Sorry about the increased hassle for making plugin updates, but it is necessary to make sure micro users are more protected (this is a proactive measure). Thanks for your help!