Use extensions

Before you start

• An isolated Shopware 6.7 installation with Administration access.
• PHP 8.2 or newer with JSON, Sodium and ZIP extensions.
• A registry URL supplied by an extension publisher.
• A current backup before testing installation or update behavior.

1. Install the connector

Download ExtensionMesh-0.1.0-beta.5.zip and the accompanying SHA256SUMS file from the release.

Optionally verify the downloaded package on Linux:

sha256sum -c SHA256SUMS

1. Open Extensions → My extensions.
2. Upload ExtensionMesh-0.1.0-beta.1.zip.
3. Install and activate ExtensionMesh.
4. Reload the Administration if the new registry navigation is not visible immediately.

2. Add a registry

1. Open Extensions → My extensions → Registries.
2. Paste either a compatible HTTPS registry endpoint or a public GitHub repository URL supplied by the publisher.
3. Add an access token only when that source requires one.
4. Save the source and select Refresh registries.

To verify registry discovery without installing another extension, use the ExtensionMesh repository itself:

https://github.com/Extension-Mesh/shopware

The connector resolves this stable repository address to its generated registry channel. It should expose the current ExtensionMesh package without a version-specific registry URL. This is only a discovery check; use a registry provided by an extension publisher for an actual extension installation.

3. Install an extension

1. Return to the existing extension list.
2. Find the compatible extension supplied by the new registry.
3. Review its source, publisher, version and compatibility information.
4. Start installation through the existing plugin lifecycle.
5. Confirm that the extension is installed and can be activated normally.

4. Test an update

Ask the publisher for a registry containing a newer compatible version, refresh registries, then run the update through the same extension screen. Confirm both the installed version and the extension behavior afterwards.

What to record during the beta

• Shopware, PHP and ExtensionMesh versions.
• Whether the source was an explicit registry URL or a GitHub repository URL.
• The exact step that failed and the visible error message.
• Relevant logs with credentials, customer data and private URLs removed.
• Whether retrying, refreshing or reinstalling changed the result.

Report reproducible problems in the connector issue tracker . For sensitive security findings, use GitHub's private vulnerability reporting instead of a public issue.

Trust and current boundaries

A registry is an independent software source. ExtensionMesh validates registry structure, compatibility information, checksums and plugin archives, but it does not certify every publisher or review every extension. Only add sources you intentionally trust.