These Registry Terms of Service (“Terms”) govern your use of Kura, the mashin package registry (the “Registry”), operated by mashin, Inc.. By creating an account, publishing a package, or downloading packages from the Registry, you agree to these Terms.
These Terms are separate from and in addition to the Cloud Terms of Service and End User License Agreement. The Acceptable Use Policy applies to your use of the Registry and is incorporated by reference. In the event of a conflict between these Terms and the Cloud Terms of Service, these Terms control with respect to Registry-specific matters.
1. Definitions
“Krate” means a software package published to the Registry, consisting of Machine definitions, code, configuration files, documentation, metadata, and cryptographic signatures.
“Machine” means a structured, governed workflow definition authored using the mashin platform. A Machine defines computation steps, governance rules, and effect declarations that the mashin runtime executes deterministically. Krates contain one or more Machine definitions.
“Publisher” means any user or organization that publishes one or more krates to the Registry.
“Consumer” means any user who searches for, downloads, installs, or uses krates from the Registry.
“Organization” means a group account on the Registry with role-based access control, which can own and manage krates on behalf of its members.
“Public Package” means a krate that is publicly listed, searchable, and downloadable by any Registry user.
“Private Package” means a krate that is only accessible to authenticated members of the owning organization.
2. Account Terms
2.1 Account Requirements
Use of the Registry requires a mashin account. Your account is subject to the account terms in the Cloud Terms of Service. In addition: You must verify your email address before publishing krates. Each individual must have a unique account; accounts may not be shared among multiple people. Machine accounts are permitted for automated publishing and CI/CD workflows, provided a single individual accepts responsibility for the account’s activity.
2.2 Organization Accounts
Organizations must designate at least one administrator. Administrators are responsible for managing member access and for all activity within the organization, including all krates published under the organization’s namespace. Members with publishing rights can publish, yank, and manage krates on behalf of the organization.
2.3 Account Responsibility
You are responsible for all activity under your account, including krates published by any team member with publishing rights to your organization’s packages. Compromised credentials must be reported immediately to [email protected].
3. Publishing Rights and Responsibilities
3.1 IP Warranty
By publishing a krate, you represent and warrant that: (a) you are the creator of the krate or have obtained all necessary rights and permissions to publish it; (b) the krate does not infringe or misappropriate any third party’s intellectual property rights, including patents, copyrights, trademarks, and trade secrets; (c) you have the authority to grant the license declared in the krate’s metadata; and (d) the krate complies with all applicable laws and these Terms.
3.2 License Declaration
Every krate published to the Registry must declare a valid license in its metadata.
- Public Packages default to Apache 2.0 if no license is specified. Publishers may select any OSI-approved open-source license.
- Private Packages may use any license, including proprietary licenses.
- The declared license governs downstream use of the krate by consumers. Publishers are responsible for ensuring that all code and content in the krate is compatible with the declared license.
- mashin, Inc. does not verify license compliance of published krates. License disputes are between the publisher, the rights holder, and affected consumers.
3.3 Signing Requirements
All published krates must be cryptographically signed using Ed25519 keys registered to the publisher’s account. mashin, Inc. verifies signatures upon upload and displays verification status to consumers. Publishers are responsible for securing their signing keys. Key compromise must be reported immediately to [email protected]; mashin, Inc. will revoke the compromised key, and affected krate versions will be flagged. Publishers may register new keys after compromise.
First-time signature verification follows a Trust On First Use (TOFU) model: the first key used to sign a krate establishes the trust anchor for that krate. Subsequent versions must be signed with the same key or a key authorized by the krate’s owner.
3.4 Verification Levels
The Registry employs a six-level verification system for published krates:
| Level | Name | What It Means |
|---|---|---|
| 1 | Signature Verified | Ed25519 signature is valid and matches a registered key |
| 2 | Tests Pass | Automated test suite passes in mashin, Inc.’s CI environment |
| 3 | Governance Compliant | Krate’s governance declarations pass policy validation |
| 4 | Security Scanned | Automated dependency and vulnerability scanning passes |
| 5 | Community Reviewed | Peer review by community members with verified track records |
| 6 | Officially Certified | Reviewed and certified by mashin, Inc.’s team |
Verification levels are displayed on registry listings to help consumers assess package quality and trustworthiness. mashin, Inc. does not warrant the correctness, security, functionality, or fitness of any third-party krate regardless of verification level. Verification is informational, not a guarantee.
4. Content Restrictions
Krates published to the Registry must not contain:
(a) Malware, viruses, trojans, ransomware, backdoors, rootkits, or any code designed to damage, disrupt, or gain unauthorized access to systems. This includes obfuscated code designed to conceal malicious functionality.
(b) Content that is illegal under applicable law, including export-controlled technology distributed without proper authorization.
(c) Code that violates the terms of its upstream licenses, including incorporating copyleft-licensed code (e.g., GPL) under an incompatible license without obtaining appropriate permissions or relicensing.
(d) Content that infringes third-party trademarks, or package names and descriptions designed to mislead consumers about the origin or affiliation of the krate (typosquatting).
(e) Personal information of individuals collected without proper consent.
5. Name Policy
5.1 Name Registration
Package names are allocated on a first-come, first-served basis within each namespace. Names must comply with the naming rules in the Registry documentation (lowercase alphanumeric characters and hyphens, 2-64 characters).
5.2 Name Squatting
Package names must have substantive content published within 30 days of initial registration. mashin, Inc. may reclaim names that: (a) have no published versions after 30 days; (b) have only trivial or placeholder content; or (c) appear to be registered solely to block others from using them. Reclaimed names become available for registration by other users.
5.3 Dispute Resolution
Name disputes are resolved at mashin, Inc.’s reasonable discretion, considering: date of registration, evidence of prior use or legitimate interest, trademark rights, community expectations and established conventions, and good faith. To dispute a package name, contact [email protected] with evidence supporting your claim.
5.4 Reserved Namespaces
The following namespaces are reserved for mashin, Inc.’s exclusive use: @mashin/* (official standard library and first-party krates) and @system/* (internal system krates). mashin, Inc. may reserve additional namespaces as necessary for platform integrity.
6. Deletion, Yanking, and Retirement
6.1 Deletion
A published krate version may be fully deleted (removed from the Registry with no record) only if both conditions are met: (a) less than 72 hours have elapsed since publication; AND (b) the version has fewer than 100 downloads. Once either threshold is exceeded, the version becomes permanent and may only be yanked.
This policy exists to protect consumers who depend on published packages. Published packages quickly become dependencies in other projects; removing them breaks downstream builds.
6.2 Yanking
A Publisher may yank a specific version of a krate at any time. Yanking marks the version as deprecated and prevents it from being resolved as a new dependency, but preserves the version for existing users who have already resolved it in their dependency trees. Yanking is permanent for the affected version. To publish a corrected version, use a new version number.
6.3 Retirement
A Publisher may retire a krate entirely by marking it as deprecated. Retired krates remain downloadable but display prominent deprecation notices. Publishers may specify a successor package (e.g., “this package has been superseded by @org/new-package”) to guide consumers to alternatives.
6.4 mashin, Inc.’s Rights
mashin, Inc. may remove, yank, or restrict access to any krate at any time if it: violates these Terms or the Acceptable Use Policy; is the subject of a valid legal complaint (DMCA takedown, court order); poses a security risk to Registry users; or is required by law.
7. Private Packages
7.1 Access Control
Organizations may publish Private Packages visible only to authenticated members of their organization. Private Package contents are not indexed in public search results and are not accessible to users outside the organization.
7.2 Confidentiality
mashin, Inc. will hold Private Package contents in confidence and will not use, access, or disclose them except as strictly required to provide the Registry service (storage, delivery, indexing). mashin, Inc. may disclose Private Package contents when required by law (with notice to the organization where legally permitted).
7.3 Data Isolation
Private Packages are logically isolated from public packages and other organizations’ private packages. mashin, Inc. implements access controls and audit logging for all access to Private Package data.
8. Consumer Rights and Responsibilities
8.1 License Compliance
By downloading and using a krate, you agree to comply with the license declared in the krate’s metadata. You are responsible for reviewing and understanding license terms before using a krate, particularly for commercial or redistributed software.
8.2 No Warranty from mashin, Inc.
mashin, Inc. does not review, audit, or endorse third-party krates. mashin, Inc. makes no representations or warranties regarding the quality, security, functionality, accuracy, or legality of third-party krates. You use third-party krates at your own risk.
8.3 Vulnerability Reporting
If you discover a security vulnerability in a published krate, you are encouraged to report it to the krate’s publisher. If the publisher is unresponsive or the vulnerability poses an imminent risk, report it to [email protected].
9. Copyright and DMCA
mashin, Inc. respects intellectual property rights. If you believe a krate infringes your copyright, submit a DMCA takedown notice to [email protected] including: identification of the copyrighted work; identification of the infringing krate and version; your contact information; a statement of good-faith belief; and a statement under penalty of perjury that the information is accurate and you are authorized to act on behalf of the rights holder.
mashin, Inc. will process valid DMCA notices promptly, notify the affected publisher, and remove or disable access to the identified content. Counter-notifications may be submitted in accordance with the DMCA. Repeat infringers may have their accounts terminated.
10. Availability and Service Levels
The Registry is provided on a commercially reasonable “as available” basis. The free tier of the Registry is provided without uptime commitments or service level guarantees. Paid plans may include SLA coverage as specified in the applicable Service Level Agreement. mashin, Inc. may impose rate limits on API access to ensure fair usage and service stability for all users.
11. Governing Law and Dispute Resolution
These Terms are governed by the laws of the State of Delaware, without regard to conflict of law principles.
Any dispute arising from or relating to these Terms shall be resolved by final and binding arbitration administered by JAMS under its Streamlined Arbitration Rules and Procedures. The seat of arbitration shall be Delaware. EACH PARTY WAIVES THE RIGHT TO A JURY TRIAL AND THE RIGHT TO PARTICIPATE IN ANY CLASS, COLLECTIVE, OR REPRESENTATIVE ACTION.
Either party may bring a qualifying claim in small claims court in Delaware.
12. Changes to These Terms
mashin, Inc. may modify these Terms at any time. Material changes will be announced with at least 30 days’ notice via email to registered publishers and on the Registry website. Continued use of the Registry after the effective date constitutes acceptance. Previous versions of these Terms are available in the repository history.
Krate Verification Levels
The Kura registry employs a six-level verification system for published packages (krates): signature verified, tests pass, governance compliant, security scanned, community reviewed, and officially certified. Verification levels are displayed on registry listings. mashin, Inc. does not warrant the correctness, security, or fitness of third-party krates regardless of verification level. Publishers warrant that they have the right to publish their krates and that published content complies with applicable licenses.
Questions? Contact mashin, Inc. at [email protected].