Overview

The registry hosts two kinds of thing: Gemara artifacts — the documents that describe controls, threats, capabilities, guidance, and more — and evaluators, the Privateer plugin binaries that turn those documents into automated checks. Both are published as content-addressed OCI artifacts, signed at publish time, and discoverable through one search.

What's in these docs

Concepts — what these artifacts are and the model behind them:

• The Gemara model — the open governance model these artifacts implement.
• Artifact types — what a control, threat, guidance, … catalog actually is.
• Evaluators — Privateer plugins that produce evaluation evidence.

Consuming artifacts — find, fetch, verify, and use them:

• Quickstart — the whole consumer path, end to end.
• Browsing & pulling — find an artifact and fetch it with grcli.
• Verifying & trust — check a release's signature.
• Reading & using — the bundle's layout, streaming, and CI.

Publishing & access — for producers:

• Publishing — publish artifacts and evaluators with provenance.
• Organizations & access — namespaces, membership, and requesting access.

Two tools

Gemara artifacts are published and pulled with grcli; evaluator plugins are published and run with Privateer's pvtr. Browsing and pulling need no account — reads are public. Publishing requires sign-in or trusted CI, because the registry accepts only artifacts that carry their own provenance (signature + attestation) — there is no upload form.

Where to start

Start with the Gemara model for the concepts, then artifact types for what each type contains. For Privateer plugins, see Evaluators.