#01 · how it works01 / 07
An app store with no store behind it.
Quiver installs software on your machine with no company in the middle to approve it, charge for it or decide what exists. This page is why that was needed and how it is built.
Quiver installs software on your machine with no company in the middle to approve it, charge for it or decide what exists. This page is why that was needed and how it is built.
The centralized store does solve the problem for the user: one catalog, one search, one button. The entire cost of that solution falls on the developer.
The court found that the 30% commission allowed Apple to earn anti-competitive margins, and barred it from preventing developers from steering users to other payment methods.
Apple charged 27% on purchases made through those links, plus design friction to discourage them. In 2025 the court found that to be a willful violation, imposed sanctions and referred the matter for criminal investigation. Affirmed on appeal.
Forced to allow alternative stores and web distribution, Apple replaced the single commission with an initial acquisition fee, a store services fee and a core technology commission, all of which apply whatever the channel.
Apple's own study found that more than 90% of the developers who moved to the alternative terms did not pass the savings on to consumers.
You don't regulate a toll booth away. You build a road with nowhere to put one.
Publishing without a middleman was solved 20 years ago. What none of those tools solved is how anyone finds what was published.
Open client and manifests in a public repository, but submissions go through manual review and the documentation says that Microsoft reserves the right to reject any submission for any reason. It doesn't accept script-based installers.
The main catalog is curated, with explicit acceptance criteria, and core dependencies cannot be replaced by formulae from other taps.
The client is free software. The store backend is proprietary, and Canonical controls it.
Designed to be decentralized: anyone can host a remote. The community ended up building Flathub to fix discovery, and today Flathub is the de facto standard.
A repository nobody knows about is functionally nonexistent.
The open systems decentralized three things at once: distribution, discovery and verification. Only the first one has to be. Quiver decentralizes distribution and builds discovery on the indexes that already exist.
Whoever makes the software writes an Arrow, the manifest that says where the program is downloaded from and what steps install it, and commits it to their own repository. There is no publish command because there is nowhere to publish to.
The name is the address: github.com/user/repository literally says where the manifest is, so there is no registry to query. To search, Quiver asks the public indexes of GitHub and GitLab for repositories tagged quiver-arrow, and validates every manifest before showing it.
A daemon on your machine reads the manifest, orders the dependencies, downloads what it needs and runs the steps. One file carries a recipe per operating system: a program installs three different ways that share no single step, and the manifest writes them once.
The manifest is compiled before it is executed, so the exact list of steps, with its commands, its URLs and the privileges it asks for, can be read before anything is touched.
Where a conventional design would put a service, Quiver leans on something the world already has.
There is no central database, no account service, no API of ours to connect to and no binary repository. It is not that we promise never to approve or charge. There is nowhere to do it from.
The daemon on each user's machine, the manifests in the repositories of the people who wrote them, the files wherever each developer put them, and the public APIs of the git hosts, queried with no credentials. Nothing else.
There is nowhere to report to. Quiver counts no installs and keeps no record of what you installed.
Quiver publishes itself as an Arrow. The daemon and the desktop app install and update through the same mechanism as anything else in the catalog.
What has already been published still installs, from any copy of the daemon already out there. No company owns this.
This is all of it: there is no fourth piece running somewhere. The code is GPL-3.0 and development goes through pull request.
The daemon, the REST API, the WebSocket channel and the CLI. One static Go binary. GPL-3.0.
view on githubThe desktop app, in Tauri and React. It has no logic of its own and ships the daemon inside. GPL-3.0.
view on githubThe state library that came out of this project, published separately and already used by another system. MIT.
view on githubIf you have something to publish, the developers page walks through writing an Arrow.