anchor.diff:  
   ---
   ## <a name="sharing-pkgs" id="sharing-pkgs" data-magellan-target="sharing-pkgs">Upload and Promote Packages</a>
  +
  +Everyone with access to the origin can view origin packages, but only origin members, maintainers, administrators, and owners can upload packages to the 'unstable' channel Origin maintainers, administrators and owners can promote packages from the 'unstable' channel.
   
   While you can build and run Chef Habitat packages without sharing them on [Chef Habitat Builder](https://bldr.habitat.sh), uploading them there enables greater collaboration and automated package rebuilds as underlying dependencies or your connected GitHub repository are updated.
   
  
positive.code: * [Download the Chef Habitat CLI](/docs/install-habitat)
  * [Create a Chef Habitat Builder account](/#builder-account)
  * [Generate a personal access token](/#builder-token)
  * [Create an origin](/#create-origin) or accept an to an existing origin
  * [Get origin keys](/#origin-keys)
  
  ### Role-Based Access Control (RBAC) for Chef Habitat Builder (SaaS and on-prem)
  
  New in: 1.6.140
  
  RBAC provides your organization with better operational safety by letting you assign specific levels of access to each origin member. With RBAC in place, existing standard origin members from earlier versions are assigned the `Maintainer` role. This role has similar permissions of the previous generic member role and the areas of difference are are detailed below. The origin owner role remains unchanged.
  
  RBAC Origin Member Roles:
  
  * Read-Only: This user can read an origin's packages, channels, members, jobs, keys, integrations, invitations, roles, settings but cannot add to, change, or delete anything else in the origin, including uploading packages and inviting members. Read-Only is the default membership role for all new origin members.
  * Member: In addition to Read-Only access, an origin Member can upload and build packages in the 'unstable' channel, but they cannot promote packages to other channels.
  * Maintainer: Current origin members are now 'Maintainers'. This role has full read and write access to packages, channels, members, jobs, integrations, invitations, settings. However, the Maintainer role is more limited than the past role, in that Maintainers only have read access to packages, channels, members, jobs, keys, integrations, and settings. Origin Maintainers can read origin member roles and see and send invitations to new members, but they cannot otherwise change origin membership--their own or anybody else's. Finally, Maintainers can neither read nor write origin secrets.
  * Administrator: In addition to Maintainer access, the Administrator role adds the missing privileges for writing origin keys and member roles, as well as for reading and writing origin secrets. Administrators have full read and write access to packages, channels, members, jobs, keys, integrations, invitations, roles, secrets, settings.
  * Owner: As in the past, the origin Owner has full read and write access to the origin. Only Owners can delete the origin or transfer ownership to another member.
  
  
negative.code: 
  ### <a name="key-tab" id="key-tab" data-magellan-target="key-tab"> The Keys Tab </a>
  
  When you create an origin, Chef Habitat Builder automatically generates an origin key pair and saves both keys. To view your origin keys on Chef Habitat Builder, navigate to your origin and select the **Keys** tab. (Builder > Origins > Keys) You will always be able to view and download origin public keys, but you will only see the private keys for origins in which you are an "administrator" or "owner".
  
  ![Viewing your origin keys](/images/screenshots/origin-keys.png)
  
  