Publishing Software

Stage and upload digest-addressed .aospkg artifacts.

Registry software is not published to npm. The release workflow builds every package, computes its SHA-256 digest, and stages:

software/
├── manifest.json
└── packages/<name>/<sha256>.aospkg

manifest.json contains a package name, exact sha256:<hex> digest, byte size, and a path relative to the manifest URL. It is a build inventory, not a semantic-version resolver.

Run the credential-free release staging path locally:

just software-artifacts-dry-run

The release workflow uploads the same directory under immutable commit and version prefixes, and copies the newest release to latest:

https://releases.rivet.dev/agent-os/<version>/software/manifest.json
https://releases.rivet.dev/agent-os/latest/software/manifest.json

The same directory also holds default-software.json, the manifest of the packages every VM installs by default. Consumers pass an artifact URL and digest from the manifest directly to software.install; see Software.