grc.store

Consumer guide

Consuming artifacts

Every artifact in the registry is a content-addressed, signed OCI bundle. Consuming one takes five steps: install the client, find the artifact, pull or stream it, verify its signature, and read it. Reads are public — no account required.

Each artifact is pinned to an immutable sha256 digest and signed at the registry. The steps below fetch an artifact and confirm its provenance; each links to a page with the full detail.

Steps

  1. Install grcli

    grcli is the command-line client for grc.store. Binaries ship as a public, signed, multi-platform OCI artifact — pull the one for your OS/arch with oras ≥ 1.3 (swap --platform to match):

    $oras pull ghcr.io/revanite-io/grcli:latest --platform darwin/arm64 && chmod +x grcli && sudo mv grcli /usr/local/bin/

    Pin a release tag such as :v0.3.0 instead of latest for reproducible installs. Full instructions — including verifying the binary itself — are in Browsing & pulling.

  2. Find an artifact

    Search lists every artifact, deduplicated to one row per (namespace, catalog_id). Filter by type or organization, open an artifact to read its release history, and copy the exact coordinate. To list versions from the terminal instead:

    $grcli versions finos-ccc/ccc.objstor.cn

    A coordinate is <namespace>/<catalog_id> plus an immutable --version. See Browsing & pulling.

  3. Pull or stream the artifact

    grcli unpack discovers the registry, mints a read token, and writes the artifact file(s) plus a bundle.json (manifest + provenance) to --output (default ./grcli-unpacked):

    $grcli unpack --repository finos-ccc/ccc.objstor.cn --version 1.0.0

    To read the content without writing files, grcli cat streams it to stdout, clean enough to pipe into yq:

    $grcli cat --repository finos-ccc/ccc.objstor.cn --version 1.0.0 | yq '.metadata.title'

  4. Verify the release

    The bundle is signed with Sigstore, and the hub recorded the signer identity when the version was published. grcli verify checks the signature against that recorded identity — no trust material to supply, no account, nothing else to install:

    $grcli verify --repository finos-ccc/ccc.objstor.cn --version 1.0.0

    grcli prints the identity it verified against, so the hub's role stays visible. To assert the identity yourself and check fully independently of the hub, pass --certificate-identity or --cosign-key. What the signature does and doesn't attest is in Verifying & trust.

  5. Read & use it

    Renderable types (control, guidance, capability, principle, threat, and vector catalogs) display in the browser on their release page — a control catalog also exposes Markdown and OSCAL tabs. On disk, bundle.json carries the manifest and provenance beside the original YAML, ready for yq/jq or a policy gate. See Reading & using.

Pointing at a different hub

Every command targets https://hub.grc.store by default. For a private or self-hosted deployment, add --url <hub> to any command, set GRCLI_URL, or set url: in a config file. Config layering and the on-disk cache are covered in Reading & using.