Build & ship · Marketplace & hubs
Marketplace & hubs
Publishing through Hive-run repositories with attestation. Anyone can run a hub.
What it is
A hub is a Hive that hosts repositories other people publish packages to and search across. There is no separate marketplace server behind it: discovery works by looking first in your own Hive, then its parent, then Hives you've explicitly marked as trusted, and it never treats a package as public unless someone in that chain actually made it public.
Search results carry a trust tier, computed from where a package came from and what has been said about it.
Because anyone can run a hub, different hubs can set different rules and apply their own bar. What stays constant is the shape of the record: which categories were checked, and by whom.
Federation only ever shares packages marked public. A package kept private to your own Hive is never surfaced to another Hive by default, on any hub.
What a person using the package notices
When they search for a package, what they see depends on where they are looking from: results from their own Hive first, then its parent, then Hives they trust. A result can carry a badge showing which categories (tests, a security scan, a license check, a human reviewer, a reproducible build) someone actually checked, so a person can tell a package that only its own author has touched apart from one a distinct reviewer or scanner looked at.
What you do as a developer
Getting into a hub's search results is a continuation of publishing and distributing: there is no separate submission process to a third party.
Publish to your repository
The same signed release event that lives on your own repository is what a hub eventually indexes; there is nothing extra to prepare just for a hub.
Announce availability to the hub's Hive
A separate announcement makes your release findable by that Hive's members, subject to whatever review its own policy requires.
Let attestations build the badge
Whoever ran your tests, scanned it for known vulnerabilities, or reviewed it as a distinct person contributes a signed record; the categories a hub actually enforces (test coverage, known vulnerabilities, license, reproducible builds, human review, and more) are its own configured policy, phrased per category as block, warn, or just a badge.
How it relates to other steps
Distribute
Announcing a release to a hub is the same announcement mechanism Distribute uses for any wider Hive.
CI
The test and scan runs a hub's policy checks for are the ones CI produces.
Test
A test-coverage badge is only as real as the attestation Test's runner actually wrote to the shared history.