bomify package pull

bomify package pull¶

Download a bomify package from an OCI registry

Synopsis¶

Pull downloads a package from an OCI registry into the data directory, as if it had been built there, along with the newest vulnerability reports attached to it. Reports are advisory: if they can't be fetched or verified, the package is still restored, with a warning.

--verify requires a signature the named plugin verifies; without it, a matching "bomify trust" rule applies. The package is verified before anything is written. --verify-provenance also requires the package's build provenance (see "bomify build --provenance"), attested by a signer the same plugin and options trust, as does a trust rule created with --require-provenance; --verify replaces a rule's requirement along with the rest of it. --insecure-skip-verify bypasses a trust rule.

--scan --fail-on scans the package fresh with each scanner (comma-separated), once it's downloaded and before it's tagged, and refuses it if any condition is met: anything at or above a severity, and/or "unscanned", a component no scanner scanned. A refused package stays untagged, for "bomify package prune" to remove. The two go together. A matching "bomify security policy" rule with --on pull does the same without flags, and its stored VEX exempts what it covers; flags override the rule, and --skip-scan ignores it. VEX the publisher attached (see "bomify push --vex") also counts, but only when this pull verifies signatures and each document's own signature verifies. Scanning may need network access.

--quiet prints only the package's pinned reference, @, with no progress or info logging.

bomify package pull <reference> [flags]

Examples¶

  # Pull a tagged reference
  bomify pull registry.example.com/myapp:latest

  # Pull by digest
  bomify pull registry.example.com/myapp@sha256:abcdef...

  # Download up to 6 layers concurrently
  bomify pull registry.example.com/myapp:latest --concurrency 6

  # Require a signature made with a specific cosign key
  bomify pull registry.example.com/myapp:latest --verify sigstore --verify-option key=cosign.pub

  # Also require build provenance attested with that key
  bomify pull registry.example.com/myapp:latest --verify sigstore --verify-option key=cosign.pub --verify-provenance

  # Print just the pinned reference of what was pulled
  pinned=$(bomify pull registry.example.com/myapp:latest --quiet)

Options¶

  -c, --concurrency int             number of layers to download concurrently (default 3)
      --fail-on conditions          fail on these comma-separated conditions: a severity (info, low, medium, high, critical) that any vulnerability at or above fails, and/or "unscanned", failing if any component no scanner scanned; replaces a matching "bomify security policy" rule's
  -h, --help                        help for pull
      --insecure-skip-verify        restore the package without verifying its signature or provenance, even if a "bomify trust" rule requires it
  -q, --quiet                       print only the restored package's pinned reference (<repository>@<digest>), with no progress or informational logging
      --scan scanners               scan the package with these comma-separated scanners (e.g. grype) before it's tagged, refusing it if --fail-on is met; overrides a matching "bomify security policy" rule's
      --skip-scan                   don't scan or gate at all, even if a "bomify security policy" rule matching the package says to
      --verify string               require a signature this signing plugin (bomify-plugin-<kind>, e.g. sigstore) verifies, overriding any "bomify trust" rule
      --verify-option stringArray   a key=value option passed through to the --verify plugin (repeatable; e.g. key=cosign.pub)
      --verify-provenance           also require the package's build provenance, attested by a signer the verifying plugin trusts

Options inherited from parent commands¶

      --data-dir string   directory to store bomify data (e.g., built packages). default is $HOME/.bomify or the value of the BOMIFY_DATA_DIR environment variable
      --docs-dir string   directory to write documentation to (if empty, no docs are generated)
      --verbose           enable verbose (debug) logging

bomify package pull