Submitting an app

Installing an app means running someone else's code on your computer. So community apps are held to a smaller reach than Forge's own, and every one is read by a person before it is listed.

What a community app may do

• Keep its own files in its own data folder, and open files you pick in its page.
• Talk to programs on your own computer, such as Jan for local AI.
• Fetch from the internet only from hosts it lists, which the store page shows.

What it may not do

• Read your home folder by itself, start other programs, or run commands.
• Handle logins, passwords, money or messages.
• Download code after it is installed, or change other apps.

The steps

1. Build it to the standard. Start from the template with forge_kit.py new; forge_kit.py check --publish --community must pass.
2. Publish a release. forge_kit.py publish uploads the zip and its sha256 to your own GitHub repo. The zip is built the same way every time, so we can rebuild it from your code and get the same file.
3. Open a submission. Send the repo, the release and the sha256. The kit lists every line that reaches further than the app declares, for the reviewer.
4. Review. A person reads the code at that exact release: what it declares in touches, the flagged lines, its packages (pinned with their hashes), and runs its tests and the app itself.
5. Listed. The store pins that one file by its sha256 and installs only that. A new version is a new review.

If something goes wrong

An app found doing more than it declares is taken off the store, and Forge stops offering its updates. Its data stays on your computer, in its own folder.