---
title: "oz0 hub submit"
description: "Usage and flags for oz0 hub submit."
canonical_url: "https://docs.oz0.ai/reference/cli/oz0/hub/submit"
---
# oz0 hub submit

> Usage and flags for oz0 hub submit.

For: Operators and developers looking up a command.

Inspect a plugin at a pinned source as `plugin inspect` does (a Git URL at --ref, pinned to its commit, the packed content's SHA-256 and the forge's repository ID; a bundle file at --url; an oci:// reference by digest) and write its listing for a hub: the plugin's name is \<publisher>/\<manifest name>, where the publisher is a reverse-DNS namespace you can prove, such as io.github.\<account> or com.example.

With --hub, the listing goes into that checkout of the hub repository, as a new listings/\<publisher>/\<plugin>.yaml or as a new version of the one there, and the pull request's text is printed (or written to --pr-text). With --hub and --sign-key, a signed copy of the submission goes next to it, as submissions/\<publisher>/\<plugin>/\<version>.json: the hub's proof that the namespace's key, not just whoever opened the pull request, lists the version. Without --hub, the listing file is printed.

With --bundle and --sign-key, it writes a submission bundle instead, signed with your key (an engine key file from `index keygen`, or an unencrypted OpenSSH ed25519 key, the one you sign release tags with), for hubs that take submissions without GitHub: send the file to the hub's maintainers, who import it with the hub's own script. The hub's CI inspects the source again with its own pinned engine, so nothing here is taken on trust.

With --hub and --check, the checkout's own checks run on the listing just written, as the hub's pull request CI runs them (hubtool check against the commit the pull request goes into, --base or the merge base of HEAD with origin's default branch, with the engine its engine.lock pins), and show the same findings; it fails when they block the listing. It refuses a plugin past the README's limits or without a licence file (the docs page Plugin limits).

## Usage

```bash
oz0 hub submit <git-url | bundle.tar.gz | oci://registry/repository@sha256:digest> --publisher <namespace> [flags]
```

## Flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --allow-local
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      let a remote source reach every address, this machine's included, and plain http:// and file://, for a repository or registry you serve yourself; without it a remote source reaches public addresses over https:// only, and the networks --allow-net lists
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --allow-net
      </code>
    </td>
    
    <td>
      strings
    </td>
    
    <td>
      
    </td>
    
    <td>
      a private network, such as 10.20.0.0/16, a remote source may reach over <code>
        https://
      </code>
      
      ; this machine's own addresses (inside a listed network too), its link and metadata services need --allow-local; repeatable
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --base
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        the merge base of HEAD with the checkout's origin/HEAD or origin/main, else HEAD
      </code>
    </td>
    
    <td>
      with --check: the commit the pull request goes into, which the checks diff against
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --bundle
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      write a signed submission bundle to this file, for a hub that takes submissions without GitHub
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --check
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      with --hub: run the checkout's own checks (its hubtool, built if needed) on the listing, as the hub's pull request CI does
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --engine-source
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      with --check: an engine checkout to build the engine the hub's engine.lock pins from, when the hub's cache has none
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --forge
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        from the host
      </code>
    </td>
    
    <td>
      the forge that hosts the repository: github, gitlab, gitea or none
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --homepage
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the plugin's homepage, an https:// address
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --hub
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      a checkout of the hub repository: write listings/&lt;publisher>/&lt;plugin>.yaml there
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --issues
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      where to report bugs, an https:// address
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --maintainer
      </code>
    </td>
    
    <td>
      stringArray
    </td>
    
    <td>
      
    </td>
    
    <td>
      a maintainer, as "Name &lt;email>" or a name; repeatable
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --new-version
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      for a --bundle: the plugin is listed already, so this is a new version, not a first listing
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --path
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the plugin's folder in the repository
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --pr-author
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        $HUB_PR_AUTHOR
      </code>
    </td>
    
    <td>
      with --check: the forge account that will open the pull request, for the check of who changed the listing
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --pr-text
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      write the pull request's text to this file (title on the first line) instead of printing it
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --publisher
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      your reverse-DNS namespace, such as io.github.&lt;account> or com.example: the plugin is listed as &lt;publisher>/&lt;manifest name>
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --ref
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      branch, tag or full commit SHA (default: the latest release tag, else the default branch); the listing pins the commit
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --repository-id
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the forge's ID of the repository, instead of asking the forge
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --security
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      where to report a security problem, besides the hub's own report link: an https:// or mailto: address
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --sign-key
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the key to sign the submission with: an engine key file (index keygen) or an unencrypted OpenSSH ed25519 key; with --hub, a signed copy goes into the checkout's submissions/
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --summary
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        the manifest's description, which must then fit
      </code>
    </td>
    
    <td>
      one or two sentences about the plugin, at most 500 characters
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --tag
      </code>
    </td>
    
    <td>
      stringArray
    </td>
    
    <td>
      
    </td>
    
    <td>
      a tag for the hub's search, such as support or github: 1 to 32 lowercase letters, digits and dashes; repeatable, up to the hub's tags.yaml max_per_listing with --hub
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --track
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      tags: the hub's bot lists every release tag your signing identity signs (none by default)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --url
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      for a bundle file: the https:// URL it is published at
    </td>
  </tr>
</tbody>
</table>

## Inherited flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --context
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        $OZ0_CONTEXT or &lt;config dir>/orchestrator-zero/context.json
      </code>
    </td>
    
    <td>
      CLI context file written by server init
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --log-level
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        info
      </code>
    </td>
    
    <td>
      log level: debug, info, warn or error
    </td>
  </tr>
</tbody>
</table>

See [all `oz0` commands](https://docs.oz0.ai/reference/cli/oz0) and the [global flags](https://docs.oz0.ai/reference/cli/oz0#global-flags).


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.