Fetch a verified release archive

stado release fetch gives an installer the exact qualified archive for a source revision it has accepted. It does not compile, sign, publish, promote, unpack, install, or restart a product.

Command

stado release fetch "$PRODUCT" "$VERSION" \
  --platform "$PLATFORM" \
  --source-commit "$COMMIT" \
  --destination "$CHECKOUT/.wisent-output/install/$PRODUCT/$VERSION/$PLATFORM/release.tar.gz" \
  --json

Use the product, version, platform and full lowercase Git commit from the accepted release record. CHECKOUT is an absolute path to the owning product's canonical checkout. Read publication state with stado release status "$PRODUCT" --json. Fetching does not decide which source is acceptable or which candidate should become stable; those remain the caller's acceptance and promotion decisions.

The command uses Stado's existing release verifier. It reads the immutable coordinate, compares the signed source with the authoritative source claim, requires passed qualification and a key trusted by registry.release_control, and checks the manifest signature. A model's statement that tests passed is not a substitute for that qualification.

Only after those checks and the expected-source comparison does it download the archive. Its SHA-256 must match the signed manifest. The destination is created atomically without replacing existing data. A repeated call verifies a regular destination's actual bytes and reuses it only when its digest still matches. No provider credential or signing key is written beside the archive.

Receipt and refusals

JSON contains coordinate (including schema version, product, version, platform and source revision), artifact (the verified manifest, signature and archive references and digests), destination, and artifact_bytes. This proves the downloaded archive, not installation or first use.

A source mismatch reports published release attests …, not accepted source …; nothing was downloaded or installed. A non-regular existing destination is refused. Different existing bytes report contains different bytes; nothing was overwritten. A downloaded digest mismatch leaves the destination unwritten. Missing qualification, an untrusted key, a bad signature, an unavailable object service, and filesystem failures preserve their actual cause and exit nonzero. No refusal falls back to a local build or a different revision.

The destination must be an absolute archive filename. Use a separate coordinate-specific path for each version. A failed write can be retried at the same path: an already persisted matching archive is read back, while a different file is never overwritten. The private staging file is created next to that destination and removed by its owner on normal completion or failure.

Stado Desktop

On Releases, choose Available operations… → Fetch a verified archive for an accepted source revision (does not install). Enter the release product, exact version, published platform, accepted full commit and absolute destination filename on the selected Stado API host. The review shows the command before execution. The existing operation receipt retains stdout, stderr and the exit status, including a refusal. The archive is written on that API host, not implicitly on the computer displaying Desktop.

Installers must still validate the fetched archive they consume, replace only their own installed files, and read back installed source identity and consumer readiness. A successful fetch alone cannot complete delivery.