The package policy

The registry is for libraries people use in their FutureBlitz programs. The package site’s package policy is the full text; this is what it says, in short.

Names

• A package’s name is lowercase ASCII letters, digits, and _, starting with a letter, at most 64 characters.
• Two names that are the same without their _s are one name. std, fb, futureblitz, apt, rpm, and releases are reserved, and so is any name that’s one of them without its _s.
• Names are first come, first served. Don’t choose one to be mistaken for another package, or to look as though the FutureBlitz project made it.

What isn’t allowed

• Squatting: publishing a placeholder, with no real code, to hold a name. The registry’s admins delete such a package’s versions, and its name stays taken. A small or early package is fine, if it’s a real start at what its name says.
• Malware and abuse: code that harms the computers it’s built or run on, steals data, or hides what it does; packages meant to deceive; anything illegal or infringing; and spam. The registry’s admins delete these packages’ versions when they’re found.

Report a package that breaks the policy, or has a security flaw.

Versions

• A version never changes. Once published, its archives stay as they are.
• Yanking a version keeps new resolutions from picking it, while programs whose fb.lock has it still build. fb yank does it, and --undo takes it back.
• Deleting a version removes it for good, and its number is never published again. Its publisher can delete it within 72 hours, if no other package depends on it.

Owners

A package’s owners publish, yank, and change its owners; a team’s publishers publish and yank its packages. A package nobody maintains isn’t handed to someone else on request: publish a fork under another name, and say so in its readme.

The package site’s terms cover its accounts, and FutureBlitz’s code of conduct how people treat each other there.