hull pull

Download a package from an OCI registry or an HTTP repository, and optionally unpack it.

When to use it

To vendor a copy of an upstream package into your repo, or stage one for an air-gapped install.
To inspect a package’s contents offline before installing — pair with --untar.
To fetch by chart name from an HTTP repository (--repo) with SemVer version selection, which the OCI-only hull registry pull does not do.

Reads <chart>. If it starts with oci://, hull pulls from that registry reference (--version is appended as the tag when set).
Otherwise <chart> is a name looked up in <repo>/index.yaml, so --repo is required. Hull picks the version matching --version, or the latest when it is unset.
Downloads the archive into --destination (default the current directory). With --prov, the .prov provenance sidecar is fetched alongside.
With --verify, the provenance signature is checked before the archive is kept; a bad signature aborts the pull.
With --untar, the archive is extracted into --untardir (default <destination>/<chart>).
Prints the path of the archive, or the extraction directory when unpacked.

hull pull <chart>

<chart> is either an oci://… reference or a chart name used with --repo.

Flag	Type	Default	Description
`--version`	string	””	Version to pull. Unset takes the latest available.
`--destination`	string	`.`	Directory the archive is saved in.
`--repo`	string	””	HTTP repository URL containing `index.yaml`. Required for non-OCI chart names.
`--untar`	bool	false	Extract the archive after downloading.
`--untardir`	string	””	Directory to extract into. Default `<destination>/<chart>`.
`--prov`	bool	false	Also download the `.prov` provenance sidecar.
`--verify`	bool	false	Verify the provenance signature before saving; a bad signature aborts.
`--ca-file`	string	””	CA bundle to trust for an HTTPS repository.
`--cert-file`	string	””	Client certificate for mutual-TLS to the repository.
`--key-file`	string	””	Client key paired with `--cert-file`.

Global flags are inherited from hull.

You want version 1.2.3 of my-app from an HTTP repository, unpacked so you can read it, then installed.

INPUT:

hull pull my-app --repo https://charts.example.com --version 1.2.3 \
  -d ./pulled --untar

OUTPUT:

Pulled and extracted: ./pulled/my-app

RESULT: the archive is fetched and expanded, leaving a package directory at ./pulled/my-app that you can inspect or install:

hull install hello ./pulled/my-app -n staging --create-namespace

Pulling an OCI reference instead writes the archive and names it:

hull pull oci://ghcr.io/example/charts/my-app --version 1.2.3 --destination ./pulled

Pulled oci://ghcr.io/example/charts/my-app:1.2.3 to ./pulled/my-app-1.2.3.hull.tgz