Build & ship · Distribute
Distribute
Upload to your own Hive and share with friends, or list it on a hub. A NAOMS-run hub adds extra validation on top; anyone can run a hub.
What it is
Distributing a package means signing a release and publishing it to your repository's shared history on a Hive. That publish is the distribution itself: it is already visible to the people already in that Hive, with no extra step needed. Making the package findable and installable by a wider Hive's members is a separate, deliberate action.
A release is packed and signed as one unit before it ever leaves your machine, so what a recipient installs is exactly what you built; nothing in it can be quietly altered afterward.
Making a release available to a wider Hive is a distinct announcement, separate from publishing it. Whether it needs anyone else's sign-off is a policy the hosting Hive sets.
A publisher can never satisfy the review requirement for their own release: a second, credentialed person must be the one who signs off on a package before it can go out as reviewed.
What a person using the package notices
When someone opens their package manager, the packages offered to them are the ones announced to their Hive. If the Hive requires a distinct review or a clean security scan before a package can be announced this way, what a person notices is that packages without that record simply are not offered there; there is no visible pass or fail status.
What you do as a developer
One command carries a release from your machine to the point where other people can find it.
Sign and publish the release
Publishing packs and signs your release and appends it as an event in your repository's shared history, which lives on a Hive. That published event is itself real, shareable distribution.
Announce it to a wider Hive, if you want reach beyond your own
A separate announcement step extends a release's visibility to a Hive's own members generally, beyond the people already following your repository directly.
Have someone else vouch for it, when the Hive asks for that
If the hosting Hive requires a review before that announcement goes out, a distinct, credentialed reviewer countersigns your release. Signing your own release does not count as review. The platform refuses that by name, as its own explicit outcome, instead of silently accepting it.
Repositories themselves are created with a single dedicated command:
// creates a new repository as its own signed chain under a Hive
naoms repo create --parentChainId <hive-id> --name <repo-name>
How it relates to other steps
CI
The test and scan records a distribution decision reads come from CI runs; Distribute does not run those checks itself.
Test
Whether a version has a test attestation at all can be part of the same review a hub or Hive requires before announcing it.
Marketplace & hubs
A hub is what a package becomes searchable through once it has been announced this way.