Downloading Artifacts

curl -H "Authorization: Bearer $TOKEN" -L \
  "https://registry.example.com/v1/org/acme/artifacts/sha256:e3b0c4429.../manifest" \
  -o manifest.json

curl -H "Authorization: Bearer $TOKEN" -L \
  "https://registry.example.com/v1/org/acme/artifacts/sha256:a1b2c3d4.../bundle" \
  -o bundle.tar.gz

curl -H "Authorization: Bearer $TOKEN" -L \
  "https://registry.example.com/v1/org/acme/artifacts/sha256:789abc.../evidence/sbom" \
  -o sbom.json

// Create a client that does not follow redirects automatically
client := &http.Client{
    CheckRedirect: func(req *http.Request, via []*http.Request) error {
        return http.ErrUseLastResponse
    },
}

req, _ := http.NewRequest("GET", registryURL+artifactURL, nil)
req.Header.Set("Authorization", "Bearer "+token)

resp, err := client.Do(req)
if err != nil {
    return err
}
defer resp.Body.Close()

// Handle redirect to presigned URL
if resp.StatusCode == http.StatusFound || resp.StatusCode == http.StatusTemporaryRedirect {
    redirectURL := resp.Header.Get("Location")
    // Fetch from presigned URL WITHOUT the Authorization header
    req, _ = http.NewRequest("GET", redirectURL, nil)
    resp, err = http.DefaultClient.Do(req)
    if err != nil {
        return err
    }
    defer resp.Body.Close()
}

// Read artifact bytes from resp.Body

# Compute the digest of the downloaded file
COMPUTED="sha256:$(sha256sum bundle.tar.gz | awk '{print $1}')"

# Compare with the expected digest from resolution
EXPECTED="sha256:a1b2c3d4e5f6..."

if [ "$COMPUTED" != "$EXPECTED" ]; then
  echo "INTEGRITY CHECK FAILED"
  echo "Expected: $EXPECTED"
  echo "Got:      $COMPUTED"
  rm bundle.tar.gz
  exit 1
fi

echo "Integrity verified"

import (
    "crypto/sha256"
    "encoding/hex"
    "fmt"
    "io"
    "os"
)

func verifyDigest(filePath, expectedDigest string) error {
    f, err := os.Open(filePath)
    if err != nil {
        return fmt.Errorf("opening file: %w", err)
    }
    defer f.Close()

    h := sha256.New()
    if _, err := io.Copy(h, f); err != nil {
        return fmt.Errorf("computing digest: %w", err)
    }

    computed := "sha256:" + hex.EncodeToString(h.Sum(nil))
    if computed != expectedDigest {
        return fmt.Errorf("digest mismatch: expected %s, got %s",
            expectedDigest, computed)
    }

    return nil
}

curl -H "Authorization: Bearer $TOKEN" \
  -H "If-None-Match: \"sha256:a1b2c3d4e5f6...\"" \
  "https://registry.example.com/v1/org/acme/artifacts/sha256:a1b2c3d4.../bundle"

# No Authorization header needed for public packages
curl -L \
  "https://registry.example.com/v1/org/acme/artifacts/sha256:a1b2c3.../bundle" \
  -o bundle.tar.gz

#!/bin/bash
set -euo pipefail

REGISTRY_URL="https://registry.example.com"
TOKEN="your-token"
ORG="acme"
NAME="weather-service"
REF="1.0.0"
OUTPUT_DIR="./downloaded"

mkdir -p "$OUTPUT_DIR"

# 1. Resolve
echo "Resolving $ORG/$NAME@$REF..."
RESOLVED=$(curl -sf -H "Authorization: Bearer $TOKEN" \
  "$REGISTRY_URL/v1/org/$ORG/mcps/$NAME/resolve?ref=$REF")

VERSION=$(echo "$RESOLVED" | jq -r '.resolved.version')
MANIFEST_URL=$(echo "$RESOLVED" | jq -r '.resolved.manifest.url')
MANIFEST_DIGEST=$(echo "$RESOLVED" | jq -r '.resolved.manifest.digest')
BUNDLE_URL=$(echo "$RESOLVED" | jq -r '.resolved.bundle.url')
BUNDLE_DIGEST=$(echo "$RESOLVED" | jq -r '.resolved.bundle.digest')
BUNDLE_SIZE=$(echo "$RESOLVED" | jq -r '.resolved.bundle.size_bytes')

echo "Resolved to version $VERSION (bundle: $BUNDLE_SIZE bytes)"

# 2. Download manifest
echo "Downloading manifest..."
curl -sfL -H "Authorization: Bearer $TOKEN" \
  "$REGISTRY_URL$MANIFEST_URL" -o "$OUTPUT_DIR/manifest.json"

# 3. Verify manifest digest
COMPUTED="sha256:$(sha256sum "$OUTPUT_DIR/manifest.json" | awk '{print $1}')"
if [ "$COMPUTED" != "$MANIFEST_DIGEST" ]; then
  echo "Manifest digest mismatch!"
  exit 1
fi
echo "Manifest integrity verified"

# 4. Download bundle
echo "Downloading bundle..."
curl -sfL -H "Authorization: Bearer $TOKEN" \
  "$REGISTRY_URL$BUNDLE_URL" -o "$OUTPUT_DIR/bundle.tar.gz"

# 5. Verify bundle digest
COMPUTED="sha256:$(sha256sum "$OUTPUT_DIR/bundle.tar.gz" | awk '{print $1}')"
if [ "$COMPUTED" != "$BUNDLE_DIGEST" ]; then
  echo "Bundle digest mismatch!"
  exit 1
fi
echo "Bundle integrity verified"

# 6. Download evidence (if any)
EVIDENCE_COUNT=$(echo "$RESOLVED" | jq '.resolved.evidence | length')
for i in $(seq 0 $((EVIDENCE_COUNT - 1))); do
  KIND=$(echo "$RESOLVED" | jq -r ".resolved.evidence[$i].kind")
  EV_URL=$(echo "$RESOLVED" | jq -r ".resolved.evidence[$i].url")
  EV_DIGEST=$(echo "$RESOLVED" | jq -r ".resolved.evidence[$i].digest")

  echo "Downloading evidence: $KIND..."
  curl -sfL -H "Authorization: Bearer $TOKEN" \
    "$REGISTRY_URL$EV_URL" -o "$OUTPUT_DIR/$KIND.json"

  COMPUTED="sha256:$(sha256sum "$OUTPUT_DIR/$KIND.json" | awk '{print $1}')"
  if [ "$COMPUTED" != "$EV_DIGEST" ]; then
    echo "Evidence ($KIND) digest mismatch!"
    exit 1
  fi
  echo "Evidence ($KIND) integrity verified"
done

echo "All artifacts downloaded and verified successfully"