download-sbom: make auth work with curl < 7.83.0

[chmeliik]

RHTAPBUGS-1289

Curl versions lower than 7.83.0 do not support the %header{...} syntax.
Write out all the headers and pick out the one we need using sed.

[chmeliik]

Tested as follows:

yq < task/download-sbom-from-url-in-attestation/0.1/download-sbom-from-url-in-attestation.yaml '.spec.steps[1].script' |
  sed -e 's/^jq .*/download_blob "$1" "$2"/' -e '/^download_blob "/q' > /tmp/download-blob.sh

podman run --rm -ti -v "/tmp/download-blob.sh:/tmp/download-blob.sh:z" quay.io/konflux-ci/appstudio-utils:ab6b0b8e40e440158e7288c73aff1cf83a2cc8a9@sha256:24179f0efd06c65d16868c2d7eb82573cce8e43533de6cea14fec3b7446e0b14 \
  bash /tmp/download-blob.sh ghcr.io/chmeliik/checkton@sha256:00f15a577971426bfbc5f08057f3d4caa6104648acf8b459b4d208f342d4fb1c /dev/null

Output on main:

GET https://ghcr.io/v2/chmeliik/checkton/blobs/sha256:00f15a577971426bfbc5f08057f3d4caa6104648acf8b459b4d208f342d4fb1c
Got 401, trying to authenticate
No auth found for ghcr.io
Trying to get token anonymously
GET %header{www-authenticate}?service=%25header%7Bwww-authenticate%7D&scope=%25header%7Bwww-authenticate%7D
curl: (6) Could not resolve host: %headerwww-authenticate
curl: (6) Could not resolve host: %headerwww-authenticate
curl: (6) Could not resolve host: %headerwww-authenticate
curl: (6) Could not resolve host: %headerwww-authenticate

Output here:

GET https://ghcr.io/v2/chmeliik/checkton/blobs/sha256:00f15a577971426bfbc5f08057f3d4caa6104648acf8b459b4d208f342d4fb1c
Got 401, trying to authenticate
No auth found for ghcr.io
Trying to get token anonymously
GET https://ghcr.io/token?service=ghcr.io&scope=repository%3Achmeliik%2Fcheckton%3Apull
GET https://ghcr.io/v2/chmeliik/checkton/blobs/sha256:00f15a577971426bfbc5f08057f3d4caa6104648acf8b459b4d208f342d4fb1c

[simonbaird]

I gave the download_blob function a test locally it worked fine.

My www_authenticate header looks like this:

www_authenticate=Bearer realm="https://quay.io/v2/auth",service="quay.io",scope="repository:sbaird/debugrepo:pull"

It finds the auth:

Found auth for quay.io in /run/user/1000/containers/auth.json

And correctly downloads a blob:

GET https://quay.io/v2/auth?service=quay.io&scope=repository%3Asbaird%2Fdebugrepo%3Apull
GET https://quay.io/v2/sbaird/debugrepo/blobs/sha256:cc296d75b61273dcb0db7527435a4c3bd03f7723d89a94d446d3d52849970460
/tmp/download-sbom-task.out.EovTrF
zzsbom.json

Sanity check the downloaded file:

$ file zzsbom.json 
zzsbom.json: gzip compressed data, original size ...

[simonbaird]

Nice.