Sign and publish

Generate a key

nimbus extension keygen

This writes an Ed25519 private key to ~/.nimbus/publisher-key (or --out <path>) and prints the public key. --force overwrites an existing key. Keep the private key; it is the only thing that can publish as you.

Sign

nimbus extension sign .

sign fills publisher.key with the public half of your key when publisher.id is set and no key is, then signs the manifest. It refuses to re-key a manifest that names a different key, and refuses a malformed funding or license. Re-sign after any change to the manifest, and bump version for each publish: a published <id>@<version> is never overwritten.

Pack (optional)

nimbus extension pack . --out ./package.tgz

Offline; the package is nimbus.extension.json, everything under dist/ and evals/, and top-level README* and LICENSE*. publish packs for you; you need pack only for a registry that adds packages by hand.

Publish

nimbus extension publish . --registry-repo <owner>/<repo>

<owner>/<repo> is your registry’s GitHub repository (the reference uses nimbus-agent/extensions as its example). publish validates the package against the registry’s own rules and its published state, then opens a pull request from a fork, with gh if it is signed in. Otherwise, or with --no-pr, it prints the branch and the commands to finish by hand. It needs no gateway or Vault. After the merge, a registry maintainer approves the registry’s signing run, which signs your version into its index. --channel stable|beta picks the channel.

A registry may require a namespaced id (publisher/name), and every segment must start with a letter or digit. A package scaffolded with --publisher qualifies; one scaffolded without it has no namespace and a registry that requires one refuses it, so scaffold with --publisher or add the namespace to the manifest id before publishing.

Rotate or revoke a key

nimbus extension keygen --out ~/.nimbus/publisher-key-2
nimbus extension key rotate --from ~/.nimbus/publisher-key --to ~/.nimbus/publisher-key-2 --publisher acme
# remove the "key" line from "publisher" in nimbus.extension.json, then:
nimbus extension sign . --key ~/.nimbus/publisher-key-2
nimbus extension publish . --registry-repo <owner>/<repo> --statement ./<statement id>.json

Keep private keys outside your package directory (the scaffold’s .gitignore does not exclude them). A rotation is signed by the old key and goes in the same pull request as the first publish under the new key. sign refuses a manifest whose publisher.key is a different key, so remove publisher.key before signing with the new key; sign then fills in the new public key. Revocation is permanent: installed code signed by the revoked key, or by a key rotated from it, stops running until its owner re-approves it. A revocation of your current key cannot ride a publish; key revoke tells you to send it as its own pull request.

The official registry

Every Nimbus release carries one registry, nimbus-official, which users do not add. It publishes through its own script, not through nimbus extension publish, so this flow does not submit to it. Its one extension today is Readwise, and this page promises no listing.