Assets and cloud sources

File content (inline or rendered from a template), file source, and .deb archives are copied into the bundle when you compile. Identical content is stored once. Applying never reads the original files.

Local sources

file "config" {
  path   = "/etc/app-config.json"
  source = "assets/config.json"
  mode   = "0640"
}

Source paths are relative to the directory of the module that declares them, or to the configuration directory. They must be regular files inside that directory: absolute paths and .. are refused.

For file resources, an optional checksum is sha256: followed by 64 lowercase hexadecimal digits. Checksums require source and cannot accompany inline content. Dpkg’s checksum uses the bare 64-character lowercase SHA-256 hex digest; see package.

S3 and GCS file content

File sources also support s3://bucket/object and gs://bucket/object. Supply the actual object’s digest in checksum; cloud checksums are mandatory. This template requires replacement before validation:

file "cloud_config" {
  path     = "/etc/app-config.json"
  source   = "s3://example-config/releases/config.json"
  checksum = "sha256:<replace with 64 lowercase hex digits>"
  mode     = "0640"
}

validate and compile download the object and check its checksum. The bundle stores the bytes, not the location or credentials, so plan and apply need no cloud access. Moving an object without changing its bytes doesn’t change the catalog.

Object keys are literal UTF-8, including literal percent characters. Empty components, leading/trailing/repeated slashes, ./.., control characters, query strings, and fragments are rejected. Unknown URI schemes fail. Cloud sources are not supported for package archives or SSH public keys; those are local bundled sources. Pinned remote module packages are a separate preparation workflow through rivet init.

Credentials

Credentials come from the environment of the process that compiles, never from configuration.

• S3: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, optional AWS_SESSION_TOKEN, plus supported web-identity/container/instance-role providers. Set AWS_REGION or AWS_DEFAULT_REGION; the default region is us-east-1. Shared profiles and SSO are not loaded.
• GCS: service-account or authorized-user ADC via GOOGLE_APPLICATION_CREDENTIALS or the conventional gcloud ADC file, GOOGLE_SERVICE_ACCOUNT files, or instance metadata credentials. External-account (federated) credentials aren’t supported.

Credentials never enter the bundle. Download failures exit with 1; invalid declarations and checksum mismatches exit with 2.

Bounds and validation

Requests use HTTPS and preserve exact stored bytes, including gzip-encoded objects. Each download has a 60-second network budget, 10-second connection timeout, 30-second request timeout, at most two retries, and bounded reads. Final bundle and combined member data must fit 256 MiB.

Direct compilation doesn’t cache downloads, list prefixes, or select object versions. All configuration is validated before any file is downloaded, and a checksum mismatch stops compilation.

Distributed releases

When compiling a release, Rivet records where each asset is and its checksum, and the host downloads and verifies it before applying. release validate checks the checksums without downloading.

Hosts cache downloaded assets in a private directory. They need storage credentials to download them, unless the compile service uses signed asset delivery.

File validation is a separate check that runs on the host before a file is replaced.