Here's how it works. In NetBeans IDE 6.1, go to Tools | Plugins. There, in the Settings tab, you'll find that "Plugin Portal" is registered as one of the update centers, along with all the others. That means that when you go to the "Available Plugins" tab, all the plugins made available by the registered update centers are included in the "Available Plugins" tab, ready for you to install them.
"Aaaaaaaaaargh!" is what you might now be thinking. "That means that anyone can come along, create some random plugin that includes something really damaging, upload it into the Plugin Portal, and then it will be available in the Plugin Manager for the unwary user to install into their IDE, potentially wiping out everything they have on their disk, in a worst case scenario where the plugin author has malicious intent."
Not to worry, that's not how it works at all. (Although, that's EXACTLY how it works in IntelliJ. I uploaded something into their Plugin Repository some months ago and then it was IMMEDIATELY available inside IntelliJ's built-in Plugin Manager. That seemed odd to me at the time.) Instead, there's a pretty strenuous vetting process. Believe me, it's stringent. I know because I'm in it.
It all started last month, with my Zip NBMs plugin (which was inspired by Mark Stephens at JavaOne who wanted a menu item that would zip up all the NBMs in a suite). I uploaded it into the Plugin Portal. Then I saw these new components on the page:
This enabled me to specify that I want my plugin to be verified, for inclusion in the Plugin Portal's update center, i.e., the one that is automatically registered in the Plugin Manager for NetBeans IDE 6.1. There are minimal quality criteria that the plugin must meet, which is determined by verifiers, who come from the NetBeans team as well as from within the broader community.
So I specified that I wanted my plugin to be verified for 6.1:
First of all, before anything else happened, before my plugin even got into the hands of the verifiers, verification failed. Why? Because I hadn't set the name of the plugin's author (and something else I can't remember). So then I added this metadata via the plugin's Project Properties dialog box.
Then it entered the verification process correctly and I was able to watch its progress:
It failed soon thereafter, because someone spotted that it hadn't been signed. Here are the instructions for doing so. In addition, there are a couple of plugins in the Plugin Portal that should be able to help you. I need to investigate those soon.
So then I signed it and uploaded a new version. A day or so later the plugin failed again, because I hadn't included a license:
So I uploaded a new one with a license. And, guess what? Today I received my first "Go". Take a look for yourself:
I'll probably get another "NoGo" from someone before getting "Gos" from all of them. But I'm really happy with all these checks that are being done to make sure that only plugins of a basic minimal quality make it into the Plugin Manager. And, soon, I hope, my plugin will find its way into the Plugin Portal's update center, i.e., I guess that'll happen when all the verifiers give it a "Go" and then it'll be in the Plugin Manager and you, as potential users of this plugin, will be secure in the knowledge that your IDE (and much else) won't be destroyed when you install it. Thanks a lot, verifiers, you're doing a great job.