cargoship pull

Pulls a Cargoship package from a remote registry and saves it to the local filesystem

Synopsis

Downloads a package from an OCI registry or an https:// URL and writes it to the local filesystem as a single archive, so that it can be carried to a machine with no route to the registry it came from. An apply reads the same references directly, so pulling first is for staging rather than something an install needs.

–shasum checks the downloaded archive against a checksum you already hold, which is the check to use when the package is to be trusted on the strength of something other than its signature.

cargoship pull [Package] [flags]

Examples

# Pull a package into the current directory
$ cargoship pull oci://ghcr.io/my-org/my-package:1.0.0

# Pull it into ./build/ instead
$ cargoship pull oci://ghcr.io/my-org/my-package:1.0.0 --output ./build/

# Check the downloaded package against a known checksum
$ cargoship pull oci://ghcr.io/my-org/my-package:1.0.0 --shasum 4a4f1f5eb0a1e3f2c9b6d0b2b6a0d3f4c5e6a7b8c9d0e1f2a3b4c5d6e7f8a9b0

# Refuse to keep the package unless a signature validates against this key
$ cargoship pull oci://ghcr.io/my-org/my-package:1.0.0 --verify=always --key ./public-key.pem

Options

  -a, --architecture string        Architecture for OCI images and Zarf packages
  -h, --help                       help for pull
      --insecure-skip-tls-verify   Skip checking server's certificate for validity. This flag should only be used if you have a specific reason and accept the reduced security posture.
  -k, --key string                 Path to public key file for validating signed packages
      --oci-concurrency int        Number of concurrent layer operations when pulling or pushing images or packages to/from OCI registries. (default 6)
  -o, --output string              Specify the output (either a directory or an oci:// URL) for the created Cargoship distro package. (default ".")
      --plain-http                 Allow OCI registry connections over HTTP instead of HTTPS. This flag should only be used if you have a specific reason and accept the reduced security posture.
      --shasum string              Shasum of the package to pull.
      --tmpdir string              Specify the temporary directory to use for intermediate files (default "/tmp")
      --verify verifyMode          Verify the Cargoship package signature. (default if-possible)
      --zarf-cache string          Specify the location of the Zarf cache directory (default "$HOME/.cache/cargoship")

Options inherited from parent commands

      --log-file            Always write a full-verbosity debug log to a file, regardless of --log-level.
  -L, --log-format string   Select a logging format. Defaults to 'console'. Valid options are: 'console', 'json', 'dev'. (default "console")
  -l, --log-level string    Log level when running cargoship. Valid options are: warn, info, debug, trace (default "info")
      --no-color            Disable terminal color codes in logging and stdout prints.

SEE ALSO

• cargoship - CLI for cargoship installs