curling el_capitan || How do grab the pkg from Apple's CDN servers

gistfile1.txt

1. Locate the storedownload process
ps aux |grep storedown
user           494  12.3  0.2  3597016  19724   ??  S    21Sep15  31:14.11 /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd

2. Attach dtruss to the storedownloader process
sudo dtruss -p 494 2>&1 | tee storedownload

3. Start the download on the appstore application

4. Inspect the storedownload process using lsof to figure out the remote endpoints
❯❯❯ lsof -p 494 | grep TCP
storedown 494 user    8u    IPv4 0xfd9e9d19cd6369dd        0t0      TCP 192.168.200.104:57671->defra3-vip-bx-007.aaplimg.com:http (ESTABLISHED)
storedown 494 user   11u    IPv4 0xfd9e9d19cd6369dd        0t0      TCP 192.168.200.104:57671->defra3-vip-bx-007.aaplimg.com:http (ESTABLISHED

5. After the download starts, you can detach the dtruss process. You may then locate the HTTP headers in dtruss's output
 ❯❯❯ grep HTTP storedownload
write(0xB, "GET /apple-assets-us-std-000001/Purple3/v4/74/d2/82/74d28291-9db9-7ae2-305d-9b8b3f5fd463/ftk3252456602304584541.pkg HTTP/1.1\r\nHost: osxapps.itunes.apple.com\r\nX-Apple-Store-Front: 143472,13\r\nAccept-Encoding: gzip, deflate\r\nAccept-Language: en-US\r\nDate: Fri,", 0x1EA)         = 490 0
read(0xB, "HTTP/1.1 206 Partial Content\r\nx-amz-id-2: +n+5yIlIUrYvsRmn785q7apY3ox/HaiNizj7TPYVFBVZZutOn7mue3X6uZac1EQg\r\nx-amz-request-id: EA27965839EAA92C\r\nDate: Wed, 30 Sep 2015 04:34:45 GMT\r\nx-amz-meta-repo-checksum: f46f412a5a74b0122ac1a317d604758a\r\nx-amz-meta-put-", 0x1000)         = 4096 0

6. Nice... Now just build the relevant download uri using curl & profit!
  ❯❯❯ curl -v defra3-vip-bx-007.aaplimg.com/apple-assets-us-std-000001/Purple3/v4/74/d2/82/74d28291-9db9-7ae2-305d-9b8b3f5fd463/ftk3252456602304584541.pkg -H "Host: osxapps.itunes.apple.com" -H "X-Apple-Store-Front: 143472,13" -H "Accept-Encoding: gzip, deflate" -H "Accept-Language: en-US"  > e_c.pkg
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0*   Trying 17.253.57.207...
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0* Connected to defra3-vip-bx-007.aaplimg.com (17.253.57.207) port 80 (#0)
> GET /apple-assets-us-std-000001/Purple3/v4/74/d2/82/74d28291-9db9-7ae2-305d-9b8b3f5fd463/ftk3252456602304584541.pkg HTTP/1.1
> Host: osxapps.itunes.apple.com
> User-Agent: curl/7.43.0
> Accept: */*
> X-Apple-Store-Front: 143472,13
> Accept-Encoding: gzip, deflate
> Accept-Language: en-US
>
< HTTP/1.1 200 OK
< x-amz-id-2: +n+5yIlIUrYvsRmn785q7apY3ox/HaiNizj7TPYVFBVZZutOn7mue3X6uZac1EQg
< x-amz-request-id: EA27965839EAA92C
< Date: Wed, 30 Sep 2015 04:34:45 GMT
< x-amz-meta-repo-checksum: f46f412a5a74b0122ac1a317d604758a
< x-amz-meta-put-by-correlation-key: IHLX6CUNIUIIHMMY7KC3ZTEDEM
< Cache-Control: max-age=2592000, public
< Last-Modified: Wed, 30 Sep 2015 03:57:03 GMT
< ETag: "277b9329fa673d78cbc03ca65d158fd0-122"
< Accept-Ranges: bytes
< Content-Type: application/octet-stream
< Content-Length: 6081795289
< Server: ATS/5.3.2
< Age: 181731
< Via: https/1.1 defra3-edge-lx-005.ts.apple.com (ApacheTrafficServer/5.3.2), http/1.1 defra3-edge-bx-031.ts.apple.com (ApacheTrafficServer/5.3.2)
< Connection: keep-alive
<
{ [731 bytes data]
  0 5800M    0  116k    0     0  37993      0 44:27:56  0:00:03 44:27:53 37986^C