Package policy

The registry is for libraries people can use in their FutureBlitz projects. This policy says what may be published and what happens to what may not.

Names

• A package’s name is what Import names: lowercase ASCII letters, digits, and _, starting with a letter, at most 64 characters.
• Two names that are the same without their _s are one name, so foo_bar can’t be published beside foobar. std, fb, futureblitz, apt, rpm, and releases are reserved, and so is any name that’s one of them without its _s: the first three are FutureBlitz’s own, and the rest are dl.futureblitz.dev’s folders for its apt and dnf repositories and fb’s releases.
• Names are first come, first served, and a name isn’t given up because another project, a company, or a person has the same one, unless a law requires it, as a trademark’s owner may.
• Don’t choose a name to be mistaken for another package, as one a letter away from a popular one, or one that implies the FutureBlitz project made it when it didn’t.

Squatting

Taking names to hold them is squatting: publishing a package with no real code, or a placeholder, to keep a name for later, or to sell. The registry’s admins delete such a package’s versions, and its name stays taken, with nothing to add. A small package is fine, so long as it does what its name and summary say.

Malware and abuse

The registry’s admins delete these packages’ versions as soon as they’re found:

• code that harms the computers it’s built or run on, steals data, or hides what it does, such as a build step or native library that does other than its package says;
• packages meant to deceive, such as one copying another’s to put its own code in;
• anything illegal, or that infringes someone else’s copyright, trademark, or license;
• spam, and archives used to store or serve files that aren’t the package.

Report a package that’s any of these.

Yanking and deleting

• Yanking a version marks it so new resolutions skip it, while projects whose fb.lock has it still download it. Yank a version that’s broken, or has a security flaw, and publish a fixed one. A yank can be undone.
• Deleting a version takes it off the registry for good, and its number is never published again. Its publisher can delete it within 72 hours of publishing if no other package depends on it. After that, only the registry’s admins can, for legal or security reasons, such as malware.
• Versions are immutable. A version is never replaced with other contents.

Ownership

• A package’s owners publish, yank, and add and remove owners; a team’s publishers publish and yank its packages. A package always has an owner until its last one, a person or a team, is deleted, when it’s left unowned.
• An unowned or abandoned package isn’t handed to someone else on request. Publish a fork under another name instead, and say so in its readme.

Limits

An account tries at most 30 publishes an hour. A source archive is at most 10 MB, and a target’s at most 200 MB; ask for more in a new issue on FutureBlitz’s GitHub, from the link under Contact below.

Contact

Questions about these policies, and reports, go to a new issue on FutureBlitz's GitHub, which is public. A report that shouldn't be public goes to GitHub's private vulnerability reporting on FutureBlitz's repository, which only its maintainers see. The registry has no email address for them.