Signed extension ecosystem

Signed DuckDB extensions for Haybarn.

Haybarn rebuilds core and community DuckDB extensions against the Haybarn engine, signs them with the Haybarn key, and serves them from a production extension channel.

See the build matrix Install Haybarn

Today

Same INSTALL and LOAD, Haybarn trust behind it

Haybarn resolves extensions from haybarn-extensions.query.farm, verifies signatures with the Haybarn key, and caches binaries under ~/.haybarn/extensions/.

Core extension

Haybarn shell

-- Core channel: extensions built with the Haybarn engine.
INSTALL httpfs;
LOAD httpfs;

-- Then query files over HTTPS using the normal DuckDB workflow.
SELECT *
FROM read_csv('https://raw.githubusercontent.com/mwaskom/seaborn-data/master/iris.csv')
LIMIT 10;

Community extension

Haybarn shell

-- Community channel: rebuilt from duckdb/community-extensions.
INSTALL a5 FROM community;
LOAD a5;

SELECT a5_lonlat_to_cell(-122.4194, 37.7749, 10);

Core extensions are built with the engine release. Community extensions are rebuilt from the upstream DuckDB community catalog and served from the community channel.

Build matrix

Which extensions are ready right now?

Haybarn tracks engine builds, core extension builds, and community extension builds for each release, so teams can see what is ready before rollout.

See the build matrix

Side by side

What changes from DuckDB?

The SQL stays familiar. The origin, trust root, and cache location move to Haybarn. DuckDB-signed extensions do not load against Haybarn; Haybarn verifies extensions with its own key.

Property	DuckDB	Haybarn
Install syntax	INSTALL …; LOAD …;	Same SQL
Default origin	extensions.duckdb.org	haybarn-extensions.query.farm
Trust root	DuckDB Foundation key	Haybarn key
Cache directory	~/.duckdb/extensions/	~/.haybarn/extensions/

Packaging

Lockfile-managed extensions

The signed HTTP channel remains the source of truth. Extensions are published to npm today, with PyPI wheels and deeper runtime discovery rolling out — so versions can be pinned, mirrored, and reviewed.

Available

npm packages

Every community extension is published to npm today — signed and pinnable in package.json.

In progress

PyPI wheels

Per-platform wheels so extensions can be pinned in requirements.txt and mirrored internally.

Planned

Runtime discovery

Python and Node packages discover installed extension packages without changing normal SQL.

Available now

package.json

// Signed Haybarn extensions are published to npm today.
{
  "dependencies": {
    "@haybarn/ext-httpfs-h1-5-5": "202606.9.140951"
  }
}

Coming soon

requirements.txt

# Roadmap: PyPI wheels, pinnable the same way.
haybarn-ext-httpfs-h1-5-5==202606.9.140951

Expert help

Need a private extension channel?

We help teams with internal mirrors, private signing workflows, custom extension CI, and controlled rollout.

Consulting Schedule a call