Package Library

The package library is Athena's on-server content store for large installer files. Upload an MSI, EXE, ZIP, or script payload — up to 15 GB — once, and Athena keeps it with a verified SHA-256 fingerprint, optional version and tag metadata, and download statistics. Endpoints and agents pull the file back through a time-limited, signed, resumable download link. It is the simple way to host a binary inside your own network — no external repository, no file share to babysit — and works entirely offline.

What the library stores#

Each item in the library is a single uploaded file plus a small metadata record. When you upload, Athena streams the file to disk while computing its SHA-256 hash in one pass, so the fingerprint is ready the moment the upload finishes. The record tracks:

Who can do what#

Access follows the standard roles. Uploading and deleting change what is stored, so they are Admin-only; browsing, verifying, and minting a download link are open to Operators as well.

Uploading a package#

Upload is a multipart/form-data POST with the file in a file field. The maximum size is 15 GB (Packages:MaxUploadSizeGB, default 15). Athena sanitizes the file name, stores the file under a fresh identifier, and returns the new record — including its hash and a ready-to-use download link.

Use api/packages/with-metadata instead of the bare api/packages when you want to attach a display name, version, description, or comma-separated tags at upload time.

# Simple upload
curl -k -X POST -H "Authorization: Bearer <token>" \
  -F "file=@AcmeApp-1.2.3.msi" \
  https://athena.example.com:8443/api/packages

# Upload with metadata and tags
curl -k -X POST -H "Authorization: Bearer <token>" \
  -F "file=@AcmeApp-1.2.3.msi" \
  -F "displayName=Acme App" \
  -F "version=1.2.3" \
  -F "description=Production release" \
  -F "tags=production,windows,msi" \
  https://athena.example.com:8443/api/packages/with-metadata

Download links (time-limited & resumable)#

Files are fetched through a signed link rather than a bearer token, so you can hand the link to any HTTP client — a download manager, a script on an endpoint, or an agent during a deployment — without sharing your credentials. A link looks like:

https://athena.example.com:8443/api/packages/<id>/download?token=<token>&expires=<unix-time>

The token is HMAC-signed and tied to the package ID and expiry, so it cannot be forged or repurposed for another package, and it stops working once expires passes. To mint a link explicitly, call generate-url with an expiry in minutes — the default is 60 and the maximum is 1440 (24 hours); values outside that range are clamped:

# Mint a link valid for 2 hours
curl -k -X POST -H "Authorization: Bearer <token>" \
  "https://athena.example.com:8443/api/packages/<id>/generate-url?expirationMinutes=120"

The download endpoint honours HTTP Range requests, so a client that loses its connection mid-transfer can resume from where it stopped instead of starting over — important for multi-gigabyte installers over a slow link. Each successful download bumps the package's downloadCount and lastDownloadedAt.

Verifying integrity#

Because every package carries the SHA-256 hash computed at upload time, you can ask Athena to re-read the stored file and confirm it still matches — a quick way to catch silent disk corruption or tampering before you deploy something. The verify call returns the expected hash and a boolean result:

curl -k -X POST -H "Authorization: Bearer <token>" \
  https://athena.example.com:8443/api/packages/<id>/verify

A client that downloads the file can independently compute its own SHA-256 and compare it to the package's hash to prove end-to-end that the bytes it received are exactly the bytes you uploaded.

Browsing, searching & statistics#

List all packages, or pass a search term to filter by file name, display name, or description. The list is returned newest-first. Fetch a single package by ID to get its full record plus a fresh download link. The storage stats endpoint summarizes the whole library — total number of packages, total bytes used (with a friendly size), total downloads, and the largest and most-downloaded files — handy for a capacity dashboard.

# List, or search
curl -k -H "Authorization: Bearer <token>" \
  "https://athena.example.com:8443/api/packages?search=acme"

# Library-wide storage stats (Admin)
curl -k -H "Authorization: Bearer <token>" \
  https://athena.example.com:8443/api/packages/stats

REST API#

All management calls use the JWT-authenticated REST API on port 8443; send the bearer token as Authorization: Bearer <token>. Only the download endpoint is different — it authenticates with the signed link instead.

PowerShell#

The Athena PowerShell module wraps the library so you can script uploads, downloads, and audits. Sign in with Connect-Athena first. Send-, Save-, and Remove-AthenaPackage support -WhatIf/-Confirm.

# Connect, then upload with metadata
Connect-Athena -Server "athena.contoso.com"
Send-AthenaPackage -Path "C:\Installers\AcmeApp-1.2.3.msi" `
  -Name "Acme App" -Version "1.2.3" -Tags "production","windows"

# Find it, verify it, and pull it down
$pkg = Get-AthenaPackage -Search "acme" | Select-Object -First 1
Test-AthenaPackage -Id $pkg.Id
Save-AthenaPackage -Id $pkg.Id -Path "C:\Downloads"

Storage & configuration#

Packages are stored on the server under Packages:StoragePath (default ./packages). Point it at a persistent volume — in a container deployment, mount the package directory on durable storage so the library survives a restart. The relevant configuration keys are:

Related#

• Software Deployment — build multi-step install jobs and roll them out to agents, tags, and collections.
• Air-Gapped Operation — the library is entirely self-hosted, so it works with no internet access.
• Configuration — the Packages:* settings and where they live.
• PowerShell Module — the full cmdlet reference.
• API Reference — authentication and the rest of the REST surface.