Module bundle_fetch 

Fetch a .gtbundle from a remote bundle_source_uri to a local file, so op env apply can stage a revision from a registry reference without a local bundle_path on the apply host.

v1 resolves oci:// references only. Other schemes (repo://, store://, http(s)://, local paths) return OpError::NotYetImplemented — author those with a local bundle_path until the richer scheme handling in greentic-start’s bundle_ref::fetch_bundle_to_file (which this intentionally mirrors, restricted to the apply case) is consolidated into a crate both repos can share. That consolidation is a tracked follow-up; this module deliberately duplicates the minimal oci:// path rather than taking a dependency on greentic-start (which depends on this crate).

The fetch is HTTPS-only and performs NO integrity check of its own: an oci://…@sha256:… resolved digest is the manifest digest, not the .gtbundle byte digest. The caller (env_apply) hashes the returned file and gates it against the manifest’s bundle_digest, and the K8s worker re-verifies at boot (materialize_revision_from_bundle). Pulling over HTTPS to the real registry is the apply-host analog of the worker’s digest-gated boot pull.

Functions

fetch_bundle_uri_to_local

Fetch the .gtbundle archive at reference to a local cache file and return its path.