Distribution

Product model

• Free public catalog on registry.doomer.ai. Domain/name ids only (for example go/security). Login is required to pull so we can track usage — not a paywall, and there is no paid catalog SKU.
• Official signatures on catalog releases. The CLI verifies them for host execution. See Official signatures.
• Private project registry. Every project has a private namespace on registry.doomer.ai. Invited members can pull; publishers, admins, and owners can push. Project packages are not official-signed by default.

Consume the free catalog

doomer login
doomer search go/
doomer pull go/security
doomer run go/security --path .
doomer outdated
doomer pull go/security   # upgrade when outdated

Publish privately

# Pack local project into the content-addressable store
doomer pack . --name my-review

# Push to your authenticated private project namespace
doomer login --team acme
doomer push my-review:0.1.0 registry.doomer.ai/acme/my-review:0.1.0

# Consumers pull and run (untrusted for host unless signed)
doomer pull acme/my-review:0.1.0
doomer run acme/my-review:0.1.0 --path . \
  --allow-unsafe-host-execution

Commands are pack then push. There is no separate publish command.

For automated releases with GitHub Actions or Depot, follow Publish adversaries.

What gets signed

Official free-catalog packages are signed in Depot release CI after a successful push using doomer sign --key-id official-prod. End users only need a current release CLI.

Trust policy details: Execution trust model.