Publish
From the repository you already have
You publish by pushing a vX.Y.Z tag. There is no upload: the registry reads your GitHub or GitLab repository, checks the release, and lists it. Pick the way in that fits.
Have a repository
Import it
The wizard detects a Docker tool, a Python package or a guide, drafts otinstaller.yaml, asks you only for what it cannot guess, and opens a pull or merge request. Merge, run the release workflow, done.
Or from the terminal: ot import https://github.com/you/tool
Prefer to write it
Add a manifest yourself
ot init writes the manifest, a README if you have none, and the release workflow. Fill in inputs, outputs, the command and the three ethics answers; ot validate checks it as the registry will.
Teach a method
Write a guide
A guide is Markdown pages, versioned like a tool, with the tools it uses linked and installable in one command. ot init --guide scaffolds it; ot release 1.0.0 publishes it without CI.
What happens after the tag
Security model →- 01
Validate
Within a minute of the tag: the manifest, the files it names, and that the image or wheel exists. The tagged commit gets an otinstaller/publish status.
- 02
Scan
Tools: signature, vulnerabilities, secrets, malware heuristics, an SBOM and a smoke test with your test input, offline. Guides: links and personal-data checks.
- 03
Review
A new publisher's first release only: a person checks it against the acceptable-use rules, usually within 3 business days. Later releases skip this.
- 04
Publish
The status turns green, you get an email, and ot install works. The registry copies the artifact and a bundle of the repository as a backup.
What the reviewer checks
- The tool fits the acceptable-use rules (lawful investigation, due diligence, threat intelligence, journalism, research).
- The README says what data the tool touches and the ethics answers match it (contacts the target, logs in, collects personal data).
- The licence allows redistribution and upstream work is credited.
- The namespace does not impersonate a person or project, and the account is not obviously throwaway.
Outcomes: approved, changes requested with what to fix, or rejected with one appeal by email. The same rules apply to every later release automatically.
Keeping it healthy
- Every night the registry runs your test input again; three failures in a row mark the tool possibly broken until one passes.
- New tags are picked up by webhook, and by a poll every six hours as a backstop. Your dashboard shows each release and why any failed.
- Yank a version to take it off
@latest; deprecate a package to point people at a replacement; transfer it to another namespace when it changes hands.
A manifest can also be held by the registry when a repository cannot carry one; it is labelled and unsigned, and a one-click pull request moves it into the repository later.