Bash scripts for downloading Pivotal Tracker attachments. Having your Pivotal Tracker username and password you can run login.sh to log into the tracker. After that you can download as many attachments as you want until session lasts using their IDs with get-attachment.sh.

get-attachment.sh

#!/bin/bash
#
# Author: Mykola Bespaliuk
# Fetches attachment by ID into a file
# Usage: ./get-attachment.sh 12345 /path/to/output/file

USAGE="Usage: ./get-attachment.sh 12345 /path/to/output/file"

if [[ $# -ne 2 ]]; then
    echo "Wrong arguments number"
    echo $USAGE
    exit 1
fi

if [ ! -f cjar ]; then
    echo "Cookies file not found. Run ./login first"
    exit 1
fi

BASE_URL="https://www.pivotaltracker.com/resource/download/"
ATT_ID=$1
OUT_FILE=$2

curl --silent --cookie cjar --cookie-jar cjar --output $OUT_FILE "$BASE_URL$ATT_ID"

login.sh

#!/bin/bash
#
# Author: Mykola Bespaliuk
# Goes through authentication on Pivotal Tracker.
# After the script has finished you can make curl requests using obtained cookies.
#
# Usage: ./login username@example.com secret

USAGE="Usage: ./login username@example.com secret"

if [[ $# -ne 2 ]]; then
    echo "Wrong arguments number"
    echo $USAGE
    exit 1
fi;

USERNAME=$1
PASSWORD=$2
USER_AGENT="Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.22 (KHTML, like Gecko) Ubuntu Chromium/25.0.1364.160 Chrome/25.0.1364.160 Safari/537.22"
SIGNIN_URL="https://www.pivotaltracker.com/signin"
OUT_FILE="/tmp/loginresult.html"

curl --silent --cookie-jar cjar --user-agent "$USER_AGENT" --output $OUT_FILE $SIGNIN_URL

# first get line with authenticity_token that corresponds to /signin action, than retrieve the token from it
AUTH_TOKEN=$(grep "action=\"/signin.*authenticity_token.*div>" $OUT_FILE | sed s/'.*value="\([^"]\+\)".*'/'\1'/)
TZ_OFFSET="+2"

# echo "Got authenticity_token: $AUTH_TOKEN"

curl --silent --cookie cjar --cookie-jar cjar --user-agent "$USER_AGENT" \
--data "credentials[username]=$USERNAME" \
--data "credentials[password]=$PASSWORD" \
--data "time_zone_offset=$TZ_OFFSET" \
--data "authenticity_token=$AUTH_TOKEN" \
--location \
--output $OUT_FILE $SIGNIN_URL

I changed your code to make it available on PHP, and it worked !
Thanks, I love you !