# Consuming Quarry

Public images are **only** on **`oci.thepeoples.io`** (design 0009).
They are **cosign-signed**. There is no other published registry for Quarry.

Do not `bootc switch` until you have verified the signature and are on a
**throwaway** VM.

## Tags

| Tag | Meaning |
| --- | --- |
| `oci.thepeoples.io/desktop/quarry:git-<sha7>` | Immutable public build |
| `oci.thepeoples.io/desktop/quarry:stable` | Convenience alias (promotion-only) |

## Verify then pull

```bash
cosign verify --key https://thepeoples.io/keys/oci.thepeoples.io.pub \
  --insecure-ignore-tlog \
  oci.thepeoples.io/desktop/quarry:stable

podman pull oci.thepeoples.io/desktop/quarry:stable
```

(`--insecure-ignore-tlog` is temporary until Rekor is wired.)

## Publish path (no Quarry registry secrets)

1. `desktop-quarry` builds and exports an OCI layout (no registry push).
2. Layout is packaged for the platform job (Gitea generic `oci-layout`).
3. `platform/thepeoples.io` `publish-oci-registry` on `thepeoples-io`
   fetches the layout and publishes to S3 with **OpenBao** STS + cosign.

AWS and cosign material live on the platform runner via OpenBao — not as
`REGISTRY_*` secrets on `desktop/quarry`. Package upload/dispatch on
`desktop-quarry` uses an OpenBao AppRole (Actions job token lacks package write).

## Installer path (spike)

Day-0 install without importing a raw disk is the minimal-installer spike:

- Strategy: [`iso-strategy.md`](iso-strategy.md)
- Plan + helper: [`iso-spike.md`](iso-spike.md) / `scripts/iso/install-quarry.sh`
- Proven disk-image consume-gate: [`consume-gate.md`](consume-gate.md)