nsfetch.bat

<# ::
@@ setlocal disabledelayedexpansion
@@ powershell -NoProfile -ExecutionPolicy Bypass -Command "Invoke-Expression (Get-Content -Raw '%~f0')"
@@ if errorlevel 1 pause
@@ exit /b %errorlevel%
#>

$reg = "ghcr.io"
$img = "nsres/titanfall"
$tag = "2.0.11.0-dedicated-mp-vpkoptim.430d3bb"
$tok = "Bearer QQ=="

$ErrorActionPreference = "Stop"
$ProgressPreference = "SilentlyContinue" # https://github.com/PowerShell/PowerShell/issues/2138

trap { Remove-Item *.part }
Invoke-WebRequest -UseBasicParsing -Headers @{Authorization = $tok; Accept = "application/vnd.oci.image.manifest.v1+json"} -Uri "https://$reg/v2/$img/manifests/$tag" |
ConvertFrom-JSON | Select-Object -ExpandProperty layers | ForEach-Object {@{
  Digest    = $_.digest
  Path      = $_.annotations."org.opencontainers.image.title"
  Timestamp = [DateTime]::Parse($_.annotations."org.opencontainers.image.created")
}} | ForEach-Object {
  Write-Output $_.Path
  if (!$_.Digest -Or !$_.Digest.StartsWith("sha256:") -Or !$_.Path -Or !$_.Timestamp) {
    throw "wtf"
  }
  if (-not (Get-FileHash -ErrorAction SilentlyContinue -Algorithm SHA256 -Path $_.Path).Hash -ieq $_.Digest.Replace("sha256:", "")) {
    Invoke-WebRequest -UseBasicParsing -Headers @{Authorization = $tok} -Uri "https://$reg/v2/$img/blobs/$($_.Digest)" -OutFile ($_.Digest.Replace("sha256:", "") + ".part")
    if (-not (Get-FileHash -ErrorAction SilentlyContinue -Algorithm SHA256 -Path ($_.Digest.Replace("sha256:", "") + ".part")).Hash -eq $_.Digest.Replace("sha256:", "")) {
      throw "checksum mismatch"
    }
    if (Split-Path $_.Path -Parent) {
      New-Item -Force -ItemType Directory -Path (Split-Path $_.Path -Parent) | Out-Null
    }
    Move-Item -Force -Path ($_.Digest.Replace("sha256:", "") + ".part") -Destination $_.Path
  }
  Set-ItemProperty -Path $_.Path -Name IsReadOnly -Value $false
  Set-ItemProperty -Path $_.Path -Name LastWriteTime -Value $_.Timestamp
  Set-ItemProperty -Path $_.Path -Name IsReadOnly -Value $true
}

nsfetch.dockerfile

FROM alpine
RUN apk add jq wget ca-certificates
COPY nsfetch.sh /
VOLUME /mnt/titanfall
WORKDIR /mnt/titanfall
ENTRYPOINT ["/bin/ash", "-c", "test -f ok || ash /nsfetch.sh && touch ok"]

nsfetch.sh

#!/bin/sh
reg="ghcr.io"
img="nsres/titanfall"
tag="2.0.11.0-dedicated-mp-vpkoptim.430d3bb"
tok="Bearer QQ=="

trap "rm -f *.part" EXIT
wget -q -O - "https://$reg/v2/$img/manifests/$tag" --header "Accept: application/vnd.oci.image.manifest.v1+json" --header "Authorization: $tok" |
jq -r '.layers[] | [ .digest, .annotations."org.opencontainers.image.title", "@"+(.annotations."org.opencontainers.image.created" | fromdateiso8601 | tostring) ] | @tsv' |
while IFS=$(printf "\t") read -r digest path timestamp; do
  echo "$path"
  if [ -z "${digest}" ] || [ "${digest#sha256:}" = "$digest" ] || [ -z "$path" ] || [ -z "$timestamp" ]; then
    echo "wtf" >&2
    exit 1
  fi
  if [ ! -f "$path" ] || [ "$(sha256sum "$path" | head -c 64)" != "${digest#sha256:}" ]; then
    if [ "$(wget -q -O - "https://$reg/v2/$img/blobs/$digest" --header "Authorization: $tok" | tee "$digest.part" | sha256sum | head -c 64)" != "${digest#sha256:}" ]; then
      echo "checksum mismatch" >&2
      exit 1
    fi
    mkdir -p "$(dirname "./$path")" -m 755
    mv -f "$digest.part" "$path"
  fi
  touch -c -m "$path" -d "$timestamp"
  chmod 444 "$path"
done