Publisher Agreement

1. What this agreement is

1.1. This agreement is between you, as a publisher, and Júlia Klee, the operator of WolOS Hub ("we"). It adds to the Terms of Use, whose definitions (section 2) apply here. Where this agreement and the Terms of Use disagree about publishing, this agreement wins.

1.2. You accept it before you publish anything for the first time, with the accept button next to the text. The hub records the version, the SHA-256 hash of the exact text and the time. When you publish for an organisation, you accept it for the organisation too and promise that you may.

1.3. If you also hold a Certificate, the Certificate Terms apply as well.

2. Who may publish, and on what basis

2.1. To publish, you need:

to be 16 or older, with a hub account in good standing;
the Contributor Licence Agreement, the Terms of Use and this agreement accepted in their current versions;
two-factor sign-in on your GitHub account;
a public GitHub repository for each Work, which you or your organisation control;
for a first listing, the account age, repository age and activity rules in the Hub Policies.

2.2. We may refuse to let you publish if you or a Work you published broke these texts before, or if the law forbids it.

2.3. No right to a listing. Meeting every rule does not entitle you to be listed, to stay listed, to a level, or to a place in search. We decide, at our sole discretion, what we list, where the law allows.

2.4. The hub distribution licence. Distribution through the hub is a licence that we grant you. It covers:

listing your Work and including it in the signed index;
hosting copies of its files and delivering them through our network, including a content delivery network;
its verdict and version pages;
the "checked" marks and the other labels the Trust Terms describe.

2.5. The hub distribution licence is:

non-exclusive;
free;
personal to you, and to the organisation you publish for;
not transferable: you may not sell, lend, sublicense or pass it on;
revocable at our sole discretion, at any time, with or without cause, and with or without notice, where the law allows. It may be revoked for one Release, one Listing, or all of your Work.

2.6. A licence to distribute through the hub, never a licence over your code. We grant you this licence over what is ours: the hub, the signed index, its signatures and its pages. It gives us no right in your code, and it does not change, add to or replace your Work's own licence. Your own licence stays yours (section 3).

2.7. Why a licence. We use this shape on purpose. A licence that we grant, and may revoke, rests only on our own rights in the hub. That makes it enforceable in every jurisdiction, without depending on local rules about your code, consumer contracts or platform liability. The protections that the law gives you and that sections 7.2 and 11 keep still apply.

2.8. When we revoke it. The Listing, the Release or the publisher it names leaves the hub, as section 7 says. To the extent the law allows, we owe you nothing for a revocation: no payment, no notice period, no traffic, no downloads and no income (section 11). Files already signed and logged stay in the record (section 12.3), and they count, or stop counting, as the reason for the revocation says in the Certificate Terms.

3. What stays yours

3.1. You keep every right in your Work and its listing. This agreement transfers nothing to us, and takes no right over your code.

3.2. The licence you name for your Work is the licence that applies to everyone who uses it. You may use any licence, open or not, that lets people install and run the Work and that you have the right to give. This agreement never changes it.

4. What you promise

4.1. Rights. You have every right needed to publish your Work under the licence you name: it is yours, or its authors and rights holders allow it, including for every library, font, image and sound inside it.

4.2. Honest listing. The name, summary, description, icon, screenshots, licence, permissions and version say what the Work is and does. Nothing is hidden.

4.3. No harmful code. The Work contains no malware, no spyware, no stalkerware, no cryptocurrency mining without clear permission, no code that takes files, accounts, keys, money or data that are not given to it, and no code that turns off protections of WolOS or of other software.

4.4. Personal data. If your Work handles people's personal data, you say so in its listing, you link a privacy notice, and you follow the privacy laws that apply to you and to the people who use it.

4.5. The law that applies to you. You follow every law that applies to your Work and to you as its maker or seller, including where relevant: consumer law, privacy law, export and sanctions rules, rules on encryption, product liability law, and, if you make your Work available in the EU in the course of a commercial activity, the EU Cyber Resilience Act (Regulation 2024/2847) duties of a manufacturer. We are not the maker, seller, importer, distributor or supplier of your Work.

4.6. Export control and sanctions. Your Work may lawfully be published worldwide and downloaded from any place the hub serves, or your listing says clearly where it may not go. You classify your Work under the export rules that apply (for example the US Export Administration Regulations, Regulation (EU) 2021/821 and Brazilian law), and you do any filing they require. You are not a person that those laws forbid us to deal with (Terms of Use, section 21.9).

4.7. Payments outside the hub. The hub takes no payments. If your Work is paid, or sells anything, you alone deal with your customers, prices, taxes, refunds and consumer rights.

4.8. The Doctrine. Your listing, release notes and answers follow the Wonderland Doctrine.

4.9. Releases. Each Release is a GitHub release on a tag of the Work's linked repository. You do not replace a published file under the same version. A new file needs a new, higher version.

4.10. Accounts and keys. You keep your GitHub account, your organisation and your signing keys in your own hands only. Two-factor sign-in stays on.

4.11. No false promises. Your listing, release notes and anything you say about your Work never claim that it is harmless, guaranteed, made, endorsed or vouched for by WolOS, or more than "checked" on the hub.

5. What you allow us

For the hub to distribute your Work, you give us a limited permission: worldwide, free and non-exclusive, only to host, hash, scan, mirror, show and sign your files and your listing, as 5.1 to 5.5 say. It lasts as long as the Listing, and, for the signed index, the public log and the revocation list, as long as they exist, because they are how people check what they installed.

5.1. Listing. We may show the Work's name, summary, description, icon, screenshots, licence, permissions, versions, publisher, repository and release links, and the check results, on the hub, in the signed index, in WolOS, in search results and in the public log.

5.2. Checking. We may download every Release, compute its hash, open it, and run the hub's automatic checks on it, and publish what they found. For Trusted publishers, a reviewer reads each Release as the Certificate Terms describe.

5.3. Signing and records. We may sign the index that lists your Work and keep the public log of every index, check result, Certificate, withdrawal and moderation decision.

5.4. Copies and delivery. We may keep copies of each Release file, its icons and its screenshots, mirror them, deliver them through our network, and resize images for display. People may download a file from your GitHub release or from our copy; WolOS compares each one with the hash in the signed index.

5.5. Telling people. We may tell people who installed or looked at your Work about a flag, a withdrawal or a revocation, through WolOS, the hub and the public log, and say why in plain words.

5.6. No more than that. This permission is not a licence to your code. It does not let us change, sell, sublicense or relicense your Work, or use its code in our own software. Beyond what 5.1 to 5.5 need, we may do with your Work only what your licence lets everyone do.

5.7. Your Work is yours alone. Your Work, your listing and your Releases are third-party content under section 5.5 of the Terms of Use. You alone answer for them, to the people who use them and to everyone else. We give no warranty for them and take on none of your duties.

6. Waiting times and holds

6.1. A first listing and later Releases may wait before they appear or are offered as updates, as the Hub Policies say. A report, a flag, a name close to another listing, or a change of owner, key or permissions may hold a Release for a person to look at.

6.2. Waiting times protect the people who install Work. They are the same for everyone at the same level.

7. What we may do

7.1. At our sole discretion, at any time, with or without cause, and with or without notice, where the law allows, we may list or refuse to list, flag, hold, hide, delist, demote in search, or withdraw a Listing or any Release, revoke the hub distribution licence (section 2.4), add a Release to the revocation list, reclaim or rename an id or namespace, or end your right to publish. Our usual grounds are that we think:

it breaks this agreement, the Terms of Use, the Hub Policies or the Doctrine;
it breaks the law, a court or authority order applies, or a valid notice says so;
it may harm people or WolOS machines;
its repository changed owner, or your keys or account may no longer be only yours;
you asked us to.

7.2. We tell you what we did and why, as section 10.4 of the Terms of Use says, and you can ask us to look again (section 11 of the Terms of Use). Sections 10.3 and 10.6 to 10.8 of the Terms of Use apply: we may act on a reasonable suspicion, and we cooperate with authorities.

7.3. A repository that moves to another owner withdraws its Listing. A new owner starts a new listing in their own namespace.

8. Reports and incidents

8.1. When we tell you about a report on your Work, you answer within 3 days for impersonation or licence problems, and as fast as you can, at most within 24 hours, for malware or an exposed key.

8.2. Incidents. You tell us within 24 hours of learning that:

a Release contains harmful code, whoever put it there;
your GitHub account, your organisation, your repository or your build was taken over or misused;
a signing key may be in someone else's hands.

Write to julia@wolos.org with "incident" in the subject. We may withdraw Releases and revoke Certificates at once.

8.3. You cooperate with us and with authorities that investigate harm caused through your Work, as far as the law allows you to. We may give authorities information about your Work and your account as section 10.7 of the Terms of Use says.

9. Your responsibility to us

9.1. You are responsible for your Work, every version of it, and what it does on people's machines.

9.2. You defend us, and pay for it. If anyone brings a claim, demand, investigation or case against us, or against our moderators or reviewers, that comes from your Work, your software, any Release, your listing, the data your Work handles, your conduct, or your breach of this agreement or the law, you defend us at your cost and pay our reasonable costs, losses, damages, settlements and legal fees from it. This includes claims by people who used your Work, by rights holders, and by authorities.

9.3. We tell you promptly. We may take over the defence at any time, and you cooperate and keep paying the reasonable costs. We do not settle in your name without your consent; you do not settle in ours, or admit anything for us, without ours.

9.4. If you are a consumer, sections 9.2 and 9.3 apply only as section 16.3 of the Terms of Use says.

10. What a listing says, and what it does not

10.1. A Listing says who published the Work, from which repository, at which level, and what the automatic checks found in each version.

10.2. It does not say the Work is harmless, free of faults, legal in a given place or fit for any purpose. We never call it more than "checked". The Trust Terms explain each label.

11. Disclaimers and limits

11.1. Sections 14 and 15 of the Terms of Use apply. The hub, the checks and the listing come "as is" and "as available", without warranty of any kind. To the extent the law allows, we are not liable to you for any loss from listing or not listing, checking, flagging, holding, delisting, demoting, withdrawing or revoking your Work, from telling people about it, or from a pause, change, error or end of the hub, and we owe you no traffic, no downloads and no income. Consumer protections in Brazil, the EU and US states remain, as those sections say.

12. Ending

12.1. You can stop at any time: withdraw your Listings yourself, or ask us.

12.2. We can revoke the hub distribution licence, stop listing your Work, or end your right to publish, under sections 2.5 and 7. Malware, threats or misuse of keys end it at once.

12.3. When a Listing ends, what was already signed and logged stays in the public log and, where needed, in the revocation list, because that record is how people check what they installed.

12.4. Sections 2.6, 2.8, 3, 4, 5.5 to 5.7, 8.3, 9, 11, 12.3 and 13 continue after the end, with section 17.4 of the Terms of Use.

13. Changes, law and contact

13.1. We change this agreement only by a new version, as section 19 of the Terms of Use and the Changes Log say. You accept the new version before you publish again.

13.2. Section 18 (law and courts, including individual claims only where enforceable) and section 21 (general: severability, no waiver, assignment by us, entire agreement, events beyond our control, export control) of the Terms of Use apply.

13.3. Takedowns, disputes, notices and incidents: julia@wolos.org, our designated contact. Conduct: conduct@wolos.org.