How it works

Install a bundle

1. Pick a version. References work like pip:

   hub:my-bundle            # the latest version
   hub:my-bundle==1.0       # exactly 1.0
   hub:my-bundle@1.0        # the same
   'hub:my-bundle>=1.0,<2'  # the highest 1.x (quote it in a shell)
   'hub:my-bundle<=1.2'

2. Dry run first, then import:

   uac-compose import -n hub:my-bundle==1.0 --sha256 <checksum>
   uac-compose import    hub:my-bundle==1.0 --sha256 <checksum>

   --sha256 pins the file, like pip's --require-hashes. Without it, the CLI still checks the checksum the hub sends.
3. Or the UC Compose extension: Action Import, Bundle Source Composer Hub, Package my-bundle==1.0; or Bundle Source URL with the URL and the SHA-256 from the package page.

Publish a bundle

1. Sign up. An admin approves new accounts.
2. Create an API token and save it:

   mkdir -p ~/.config/uac-compose
   printf '%s' 'cmp_…' > ~/.config/uac-compose/hub-token
   chmod 600 ~/.config/uac-compose/hub-token

3. Publish:

   uac-compose publish nightly.uac.yaml nightly-transfer==1.0 \
       -d "Moves the nightly files and tells the team." --tag "file transfer"
   uac-compose publish nightly.uac.yaml nightly-transfer==1.1 --draft   # check it on the site first

4. Or use the web dashboard: paste or upload the YAML, check the draft, publish.

Rules

• A published version never changes. Delete it if you must; the number stays reserved and is never used for another file. Publish a new number instead.
• A draft is seen only by its owner and can change until it is published.
• Files are refused when they hold a secret (password, pass phrase, token), are not a valid bundle, or are over 1 MB.
• The site lists the Universal Extensions a bundle uses and draws its workflows.
• One vote and one report per approved account. A package with 15 reports is hidden until an admin checks it.