openregs pull

Vendor a release from a registry, verifying it before it is unpacked.

Copy a named release out of a registry into a local directory, and verify the whole chain — signatures, the trust anchor, digests, provenance and transparency-log inclusion — over the copied bytes BEFORE any of them reach the target path. A release that fails any check is not unpacked: the staging directory is removed and the target is left exactly as it was. Nothing is ever extracted, because a registry holds a release as a file tree and the file list comes from the release’s own signature manifest, not from a listing the registry composes. Pulling the same release twice reads one file, re-checks what is already on disk and writes nothing.

openregs pull [-h] --from <registry> [--into <path>] [--force] [--key <cosign.pub>]
                     [--log-key <log.pub>] [--trust <path>] [--root <path>]
                     <regime>@<tag>

Argument
<regime>@<tag>	the release to vendor, for example fixreg@2025.04 (required)

Option
--from <registry>	the registry to pull from: a directory (or file:// URL) laid out as <registry>/<regime>/<tag>/. There is no default — a pull that invented its own source would be exactly the wrong thing for this command to do (required)
--into <path>	the directory to vendor into; the release lands at <path>/<regime>/<tag>/. Defaults to the current directory
--force	replace an already-vendored copy instead of refusing to touch it
--key <cosign.pub>	a signing key to accept, repeatable. Given, it replaces the roster: the release’s own copy of its public key is never an anchor. Default: config/trust.yaml (repeatable)
--log-key <log.pub>	a transparency-log key to accept, repeatable (repeatable)
--trust <path>	read the trust roster here instead of config/trust.yaml
--root <path>	repository root, where the trust roster and the regime names are read from