PyneHub logoPyneHub
All legal documents

PyneHub Developer Onboarding & Vetting

Last updated: July 18, 2026

Upload/publish access to PyneHub is maintainer-controlled. A developer must complete every required step below before a maintainer grants upload permission. Public sign-up is disabled; accounts are created/approved by maintainers.

1. Vetting checklist (maintainer completes before granting access)

  • Request received with a valid, reachable developer email.
  • Email verified (developer confirmed control of the address).
  • 2FA enabled on the developer account.
  • Developer Agreement / CLA accepted (v1.0), recorded with timestamp, account id, and IP.
  • Basic reputation / sanity check of the developer and intended apps (links, prior work, stated purpose).
  • No matches against sanctions/embargo constraints (advisory; confirm process with legal/compliance).
  • Optional identity proof requested and reviewed only on suspicion of abuse, impersonation, or policy risk (e.g., government ID or domain control proof). Store minimally and delete once verified.
  • Upload permission granted (role/canUpload) by a maintainer.
  • Onboarding recorded in the audit log.

2. Exact onboarding steps (developer)

  1. Account & email verification. Receive an invite or request an account; click the verification link sent to your email to confirm ownership.
  2. Enable 2FA. Set up two-factor authentication on your account before any upload access is granted.
  3. Accept the Developer Agreement / CLA. Read legal/DEV_CONTRIBUTOR_AGREEMENT.md and check the acceptance box (text below). Acceptance is timestamped and logged.
  4. Await maintainer approval. A maintainer completes vetting and grants upload permission.
  5. Publish apps through the developer panel, providing required metadata.

3. CLA acceptance checkbox text (one line)

I have read and agree to the PyneHub Developer Agreement & Contributor License Agreement (v1.0), I have the right to publish my apps under an Apache-2.0-compatible license, my apps are not malware, and I consent to PyneHub's logging and audit.

4. Required metadata for each app upload

  • App name
  • Version (semantic version recommended, e.g., 1.0.0)
  • Short description
  • Author / publisher name
  • Category (e.g., Internet, Utilities)
  • License (must be Apache-2.0-compatible; state the SPDX id)
  • App package (the uploaded artifact) and icon
  • Declared runtime permissions / network endpoints (for user transparency)
  • (Generated automatically) SHA-256 checksum, uploader account, timestamp

5. Required account states before upload is allowed

An account may upload only when all of these are true:

  • emailVerified = true
  • twoFactorEnabled = true
  • claAcceptedAt is set (CLA accepted), matching current CLA version
  • canUpload = true (permission granted by a maintainer)
  • status = active

These are enforced server-side (see Integration Checklist).

6. Revocation

Maintainers may revoke upload permission at any time for policy violations, suspected compromise, or at the developer's request. Revocation is logged.