A script that uses `curl` to download the SBOM layer of an OCI image created with Cloud-Native buildpacks

get_sbom_layer.sh

#!/bin/bash
set -eio pipefail

IMAGE="$1"
TAG="$2"

TOKEN=$(curl -s "https://auth.docker.io/token?scope=repository:$IMAGE:pull&service=registry.docker.io" | jq -r .token)

MANIFEST=$(curl -s -L -H "Accept: application/vnd.docker.distribution.manifest.v2+json" -H "Authorization: Bearer $TOKEN" https://registry-1.docker.io/v2/$IMAGE/manifests/$TAG)

CONFIG_DIGEST=$(echo "$MANIFEST" | jq -r '.config.digest')

CONFIG=$(curl -s -L -H "Authorization: Bearer $TOKEN" "https://registry-1.docker.io/v2/$IMAGE/blobs/$CONFIG_DIGEST")

DIFFID=$(echo "$CONFIG" | jq -r '.config.Labels["io.buildpacks.lifecycle.metadata"]' | jq -r '.sbom.sha')

DIFFID_INDEX=$(echo "$CONFIG" | jq -r ".rootfs.diff_ids | index(\"$DIFFID\")")

LAYER=$(echo "$MANIFEST" | jq -r ".layers[$DIFFID_INDEX]")
MEDIA_TYPE=$(echo "$LAYER" | jq -r '.mediaType')
DIGEST=$(echo "$LAYER" | jq -r '.digest')

curl -s -L -H "Accept: $MEDIA_TYPE" -H "Authorization: Bearer $TOKEN" "https://registry-1.docker.io/v2/$IMAGE/blobs/$DIGEST" -o "$(echo "$DIGEST" | cut -d ':' -f 2).tgz"