How to download a file from GitHub Container Registry (CLI command, GitHub Packages)

Question

How can I download a package from GitHub Packages using the command-line?

I need to download a file from GitHub Packages so that it can be transferred to a machine without an Internet connection for an offline install. But it's not clear how I can download the file.

For example, let's consider the wget package in the Homebrew organization on GitHub Packages.

• https://github.com/Homebrew/homebrew-core/pkgs/container/core%2Fwget

I was successfully able to download the manifest with the following command

curl -o manifest.json -v -H "Authorization: Bearer QQ==" -H 'Accept: application/vnd.oci.image.index.v1+json' https://ghcr.io/v2/homebrew/core/wget/manifests/1.24.5

And here is an example execution of the above commands:

user@disp897:~$ curl -o manifest.json -v -H "Authorization: Bearer QQ==" -H 'Accept: application/vnd.oci.image.index.v1+json' https://ghcr.io/v2/homebrew/core/wget/manifests/1.24.5
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0*   Trying 140.82.121.33:443...
* Connected to ghcr.io (140.82.121.33) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: /etc/ssl/certs
} [5 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
* TLSv1.3 (IN), TLS handshake, Server hello (2):
{ [122 bytes data]
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
{ [19 bytes data]
* TLSv1.3 (IN), TLS handshake, Certificate (11):
{ [3256 bytes data]
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
{ [520 bytes data]
* TLSv1.3 (IN), TLS handshake, Finished (20):
{ [36 bytes data]
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
} [1 bytes data]
* TLSv1.3 (OUT), TLS handshake, Finished (20):
} [36 bytes data]
* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256
* ALPN, server accepted to use h2
* Server certificate:
*  subject: C=US; ST=California; L=San Francisco; O=GitHub, Inc.; CN=*.ghcr.io
*  start date: Jul 10 00:00:00 2023 GMT
*  expire date: Jul  9 23:59:59 2024 GMT
*  subjectAltName: host "ghcr.io" matched cert's "ghcr.io"
*  issuer: C=US; O=DigiCert Inc; CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1
*  SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
} [5 bytes data]
* Using Stream ID: 1 (easy handle 0x5f5c1971a810)
} [5 bytes data]
> GET /v2/homebrew/core/wget/manifests/1.24.5 HTTP/2
> Host: ghcr.io
> user-agent: curl/7.74.0
> authorization: Bearer QQ==
> accept: application/vnd.oci.image.index.v1+json
> 
{ [5 bytes data]
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
{ [57 bytes data]
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
{ [57 bytes data]
* old SSL session ID is stale, removing
{ [5 bytes data]
* Connection state changed (MAX_CONCURRENT_STREAMS == 100)!
} [5 bytes data]
  0     0    0     0    0     0      0      0 --:--:--  0:00:01 --:--:--     0< HTTP/2 200 
< content-length: 12448
< content-type: application/vnd.oci.image.index.v1+json
< docker-content-digest: sha256:f7dd153445ffd9ec96cc95d8829cd4afca6ca04b20acbd52cbbd13cfe9aeda5b
< docker-distribution-api-version: registry/2.0
< etag: "sha256:f7dd153445ffd9ec96cc95d8829cd4afca6ca04b20acbd52cbbd13cfe9aeda5b"
< date: Fri, 15 Mar 2024 05:16:30 GMT
< x-github-request-id: B984:0DCC:46A7360:4866BBC:65F3D9AD
< 
{ [1000 bytes data]
100 12448  100 12448    0     0   8491      0  0:00:01  0:00:01 --:--:--  8485
* Connection #0 to host ghcr.io left intact
user@disp897:~$ 

user@disp897:~$ head manifest.json 
{
  "schemaVersion": 2,
  "manifests": [
    {
      "mediaType": "application/vnd.oci.image.manifest.v1+json",
      "digest": "sha256:c5ae04188725dc26a627b5a6309b2c722cff1d1e01ca2dc822bfa0ef5d4bb2e7",
      "size": 2542,
      "platform": {
        "architecture": "arm64",
        "os": "darwin",
user@disp897:~$ 

What I can't figure out, however, is how to parse the manifest file and use it to download the actual package from the GitHub Container Registry.

How can I download an actual package from a GitHub Container Registry using curl?

Answer 1

You can use gh command to download the release.

# download all assets from a specific release
$ gh release download v1.2.3

# download only Debian packages for the latest release
$ gh release download --pattern '*.deb'

# specify multiple file patterns
$ gh release download -p '*.deb' -p '*.rpm'

# download the archive of the source code for a release
$ gh release download v1.2.3 --archive=zip

Reference: https://cli.github.com/manual/gh_release_download