Clone a repository

tovio clone <remote> <repo> <dir>

Three positional arguments, in that order:

Every transfer runs over TLS 1.3. A hosted https:// remote is trusted through the ordinary public chain. A native host:port remote has no publicly-issued certificate, so it needs a pinned one:

tovio clone <host:port> <repo> <dir> --cert <file.der>

What arrives

The object store, history, lanes, and tags. Every object is re-hashed on receipt — a mismatch surfaces as corruption rather than being accepted.

Three things transfer alongside the commit closure, authenticated separately: the repository's active policy manifest, its public access registry, and the repository-owner identity. A manifest that is not attested by that owner root, or that would move policy backwards to an older version, is refused as TVO-SYNC-008. On a clone that refusal arrives late, after the directory has been created, so remove the half-made directory before retrying — a second clone into it would refuse on the existing repository.

What the clone records for later

Cloning writes three files under .tovio/ so subsequent commands need no arguments:

• origin — the remote address and repository id. A bare tovio sync reads it.
• origin-cert.der — the pinned TLS certificate, for a native origin only. A hosted origin has none.
• relay-identity.der — the relay's serving identity key, pinned on first contact.

Protected content

A clone brings protected paths as ciphertext. Whether you can read them depends on your key and the policy, not on having cloned successfully. tovio access check <path> answers it directly, per attribute.

Large repositories

See the partial-clone article — --sparse, --blobless, --blob-limit, --depth, --no-attachments — for cloning only what you need.

If it fails