fetch-source: export the simple fetch source mechanism via cli

Signed-off-by: Łukasz 'sil2100' Zemczak <lukasz.zemczak@chainguard.dev>

Author: sil2100

docs/md/melange.md

@@ -25,6 +25,7 @@ toc: true
 * [melange compile](/docs/md/melange_compile.md)	 - Compile a YAML configuration file
 * [melange completion](/docs/md/melange_completion.md)	 - Generate completion script
 * [melange convert](/docs/md/melange_convert.md)	 - EXPERIMENTAL COMMAND - Attempts to convert packages/gems/apkbuild files into melange configuration files
+* [melange fetch-source](/docs/md/melange_fetch-source.md)	 - Download package source code
 * [melange index](/docs/md/melange_index.md)	 - Creates a repository index from a list of package files
 * [melange keygen](/docs/md/melange_keygen.md)	 - Generate a key for package signing
 * [melange license-check](/docs/md/melange_license-check.md)	 - Gather and check licensing data

docs/md/melange_fetch-source.md

@@ -0,0 +1,43 @@
+---
+title: "melange fetch-source"
+slug: melange_fetch-source
+url: /docs/md/melange_fetch-source.md
+draft: false
+images: []
+type: "article"
+toc: true
+---
+## melange fetch-source
+
+Download package source code
+
+### Synopsis
+
+Download the selected package's source code via the melange metadata.
+
+```
+melange fetch-source file target-directory/
+```
+
+### Examples
+
+```
+  melange fetch-source vim.apk sources/
+```
+
+### Options
+
+```
+  -h, --help             help for fetch-source
+```
+
+### Options inherited from parent commands
+
+```
+      --log-level string   log level (e.g. debug, info, warn, error) (default "INFO")
+```
+
+### SEE ALSO
+
+* [melange](/docs/md/melange.md)	 - 
+

pkg/cli/commands.go

@@ -56,6 +56,7 @@ func New() *cobra.Command {
 	cmd.AddCommand(completion())
 	cmd.AddCommand(compile())
 	cmd.AddCommand(convert())
+	cmd.AddCommand(fetchSource())
 	cmd.AddCommand(indexCmd())
 	cmd.AddCommand(keygen())
 	cmd.AddCommand(licenseCheck())

pkg/cli/fetch_source.go

@@ -0,0 +1,58 @@
+// Copyright 2025 Chainguard, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cli
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"github.com/spf13/cobra"
+
+	"chainguard.dev/melange/pkg/source"
+)
+
+func fetchSource() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:     "fetch-source file",
+		Short:   "Download package source code",
+		Long:    `Download the selected package's source code via the melange metadata.`,
+		Example: `  melange fetch-source vim.apk sources/`,
+		Args:    cobra.MinimumNArgs(2),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			ctx := cmd.Context()
+
+			destDir := args[1]
+			// Create destDir if it doesn't exist
+			if _, err := os.Stat(destDir); os.IsNotExist(err) {
+				if err := os.MkdirAll(destDir, 0755); err != nil {
+					return fmt.Errorf("failed to create destination directory: %w", err)
+				}
+			}
+
+			var err error
+			e := filepath.Ext(args[0])
+			if e == ".apk" || e == ".yaml" {
+				_, err = source.FetchSourceFromMelange(ctx, args[0], args[1])
+			} else {
+				err = fmt.Errorf("unsupported file type: %s", e)
+			}
+
+			return err
+		},
+	}
+
+	return cmd
+}