Publishing Software

Stage and upload digest-addressed .aospkg artifacts.

Registry software is not published to npm. The release workflow builds every package, computes its SHA-256 digest, and stages:

software/
├── manifest.json
└── packages/<name>/<sha256>.aospkg

manifest.json contains a package name, exact sha256:<hex> digest, byte size, and a path relative to the manifest URL. It is a build inventory, not a semantic-version resolver.

Run the credential-free release staging path locally:

just software-artifacts-dry-run

The release workflow uploads the same directory under immutable commit and version prefixes, and copies the newest release to latest:

https://releases.rivet.dev/agent-os/<version>/software/manifest.json
https://releases.rivet.dev/agent-os/latest/software/manifest.json

The same directory also holds default-software.json, the manifest of the packages every VM installs by default. The library resolves registry names such as { registry: "git" } against this manifest. To serve packages from a mirror, copy the <version>/software/ layout and point softwareRegistry.url or AGENTOS_SOFTWARE_REGISTRY_URL at its root; see Software.