# Smallstep package releases

> Machine-readable manifest tree for Smallstep's signed binary releases. Each
> JSON document declares the URLs of its children, so an agent can crawl the
> tree from /index.json without constructing paths. Schema version 1.0.

The tree is a four-level URL hierarchy:

- `/index.json` — products
- `/{channel}/{product}/index.json` — channel root
- `/{channel}/{product}/{os}/index.json` — version list
- `/{channel}/{product}/{os}/{version}/index.json` — files, signatures, certs

Every file entry carries `filename`, `arch`, `kind`, `format`, `url`, `size`,
`sha256`, and optional `signature_url` and `certificate_url`. Signatures are
cosign keyless, issued through GitHub Actions OIDC with the certificate
identity regex `https://github\.com/smallstep/step-agent-plugin/.*` and the
issuer `https://token.actions.githubusercontent.com`.

Entry point: [Products index](https://packages.smallstep.com/index.json): start here; lists every product with its channel URLs
Docs: [Smallstep Agent documentation](https://smallstep.com/docs/agent)

## Examples

- [step-agent on the edge channel](https://packages.smallstep.com/edge/step-agent/index.json): per-channel manifest with `latest_per_platform` and `platforms` URLs
- [step-agent / edge / darwin version list](https://packages.smallstep.com/edge/step-agent/darwin/index.json): per-OS manifest with a `versions[]` array of per-version index URLs