Fetch from OCI registry (ghcr.io)

fetch.sh

export TOKEN=$(curl --silent https://ghcr.io/token\?scope\=repository:wolfv/artifact:pull | jq -r .token)

curl \
--silent \
--request 'GET' \
--header "Authorization: Bearer $TOKEN" \
--header "Accept: application/vnd.oci.image.manifest.v1+json" \
'https://ghcr.io/v2/wolfv/artifact/manifests/1.0'

echo "\n\nFetching image content now:\n\n"

curl \
--location \
--request GET \
--header "Authorization: Bearer ${TOKEN}" \
"https://ghcr.io/v2/wolfv/artifact/blobs/sha256:c5be3ea75353851e1fcf3a298af3b6cfd2af3d7ff018ce52657b6dbd8f986aa4"

Thank you! 👏

to save to file add

curl \
--output file \

Doesn't work :(

user@disp897:~$ curl \
--location \
--request GET \
--header "Authorization: Bearer ${TOKEN}" \
"https://ghcr.io/v2/wolfv/artifact/blobs/sha256:c5be3ea75353851e1fcf3a298af3b6cfd2af3d7ff018ce52657b6dbd8f986aa4"
{"errors":[{"code":"BLOB_UNKNOWN","message":"blob unknown to registry"}]}
user@disp897:~$ 

Here is a bit a more complete example:

# Define the image that is of interest
export IMAGE="roemer/devcontainer-features/gonovate"

# Request a pull token for said image
export TOKEN=$(curl --silent "https://ghcr.io/token?service=ghcr.io&scope=repository:$IMAGE:pull" | jq -r .token)

# Fetch the manifest and parse it. NOTE: In this code, we take the first layer the image.
export LAYER_SHA=$(curl \
--silent \
--request 'GET' \
--header "Authorization: Bearer $TOKEN" \
--header "Accept: application/vnd.oci.image.manifest.v1+json" \
"https://ghcr.io/v2/$IMAGE/manifests/1.0" | jq -r .layers[0].digest)

# Download the layer
curl -o feature.tar.gz \
--location \
--request GET \
--header "Authorization: Bearer ${TOKEN}" \
"https://ghcr.io/v2/$IMAGE/blobs/$LAYER_SHA"

This article provides more examples and context:

• https://tech.michaelaltfield.net/2024/09/03/container-download-curl-wget/