Consumer guide
Browsing & pulling
Find an artifact in the web UI or from the terminal, then fetch it with grcli. Reads are public — no account needed.
The Quickstart covers the whole consumer path. This page details its first three steps: browse, install, and pull.
Browsing
Search lists every artifact the registry holds, deduplicated to one row per
(namespace, catalog_id) with the latest non-yanked version as the
representative. Filter by type with the chips, narrow by organization, or search by title, summary,
and author. Each type also has its own page (e.g. /controls), and
Evaluators lists the Privateer plugins.
Each artifact page shows its full release history; each release page surfaces the exact pull command, the manifest digest, and the layer + config blob. To list versions from the terminal instead — newest first, no account required:
$grcli versions finos-ccc/ccc.objstor.cn
Add --latest to print only the current version, for use in scripts.
The grcli CLI
grcli is the command-line client for grc.store — it validates, publishes,
pulls, and verifies Gemara bundles. Binaries are published as a public, signed, multi-platform OCI
artifact at ghcr.io/revanite-io/grcli (linux, macOS, and Windows on amd64
and arm64). Pulling needs no token, but you do need oras ≥ 1.3 on
your $PATH. Swap --platform for your OS/arch:
$oras pull ghcr.io/revanite-io/grcli:latest --platform darwin/arm64 && chmod +x grcli && sudo mv grcli /usr/local/bin/
Pin a specific release tag such as :v0.3.0 instead of
latest for reproducible installs.
Public reads need no sign-in. Sign in only for actions that write (publishing) or to reach a private organization's artifacts — a one-time OIDC device flow:
$grcli login grcli login targets this hub by default; pass
--url <hub> for a private deployment. See
Organizations & access.
Pulling
Every artifact is a content-addressed Gemara OCI bundle. grcli unpack
discovers the registry from the hub, mints the read token, verifies the signature and fails
closed (nothing is written if it can't be verified — pass --no-verify
to skip), then writes the artifact file(s) plus a bundle.json
(manifest + provenance) into --output
(default ./grcli-unpacked):
$grcli unpack --repository finos-ccc/ccc.objstor.cn --version 1.0.0
The exact command for a release is shown on its detail page with a copy button. The OCI manifest is
also reachable over HTTP at
GET /v1/catalogs/{namespace}/{catalog_id}/versions/{version}/manifest.
To stream an artifact instead of writing files, resolve references, or point grcli at a private hub, see Reading & using. To confirm a release's signature before you rely on it, see Verifying & trust.