// releases

Stable means pinned

A RivetHub stable release is a set of exact tags, digests, and checksums — not a floating latest.

// the pin file

What "stable" means here

Every fetch the installers make from RivetOS goes through one pin file, pins/stable.json in the distro repository:

rivetos_tag: the exact RivetOS tag bare-metal node installs clone
image: the GHCR agent image for --docker, preferred in digest form (@sha256:…)
pgvector_image: the Postgres 16 + pgvector image for --docker datahub installs
rivet_ca_sha256: checksum of the pinned CA library
hub_helper_version: version of the rivethub-hub helper (already a real value, 0.1.0)

When you install from the stable channel, you get exactly those artifacts. A new release is a new pin file, reviewed and tagged.

// current channel state

Current channel state

Nothing is pinned yet. Every version field in pins/stable.json is still an UNPINNED placeholder awaiting the first RivetOS stable tag (vX.Y.Z). Until then, bare-metal clones fall back to the default branch and --docker falls back to floating tags — with loud warnings from the installers. The datahub curl-pipe installer refuses to run at all in this state. Install from a checkout and read the warnings.

The machine-readable channel file is served at releases/latest.json. Its fields are filled at pin time; while unpinned they read UNPINNED / null:

releases/latest.json

{
  "rivetos": "UNPINNED",
  "datahub_sh_sha256": "UNPINNED",
  "node_sh_sha256": "UNPINNED",
  "updated": null
}

// changelog

Changelog

Release notes and the changelog live with the source: the distro repository (pins/README.md documents each pin field) and the RivetOS runtime repository, documented at rivetos.dev. When the first stable tag lands, this page will list it here.