Update downloader script, to ensure that Authorization header is not passed when downloading blobs.

Signed-off-by: Alexander Midlash <amidlash@docker.com>

contrib/download-frozen-image-v2.sh

@@ -44,6 +44,17 @@ if [ "$(go env GOHOSTOS)" = 'windows' ]; then
 	fi
 fi
 
+fetch_blob() {
+	url=$1
+	token=$2
+	dest=$3
+	echo "Attempting to download blob $url"
+	target=$(curl -sS -v -H "Authorization: Bearer $token" "$url" 2>&1 | grep "Location:" | sed 's/< Location: \(.*\)\r/\1/')
+	# curl blob (exclude auth token)
+	curl -fsS --progress "${target}" -o "$dest"
+}
+
+
 while [ $# -gt 0 ]; do
 	imageTag="$1"
 	shift
@@ -87,10 +98,7 @@ while [ $# -gt 0 ]; do
 					imageId="${configDigest#*:}" # strip off "sha256:"
 
 					configFile="$imageId.json"
-					curl -fsSL \
+					fetch_blob "https://registry-1.docker.io/v2/$image/blobs/$configDigest" $token "$dir/$configFile"
-						-H "Authorization: Bearer $token" \
-						"https://registry-1.docker.io/v2/$image/blobs/$configDigest" \
-						-o "$dir/$configFile"
 
 					layersFs="$(echo "$manifestJson" | jq --raw-output --compact-output '.layers[]')"
 					IFS="$newlineIFS"
@@ -158,10 +166,7 @@ while [ $# -gt 0 ]; do
 									continue
 								fi
 								token="$(curl -fsSL "https://auth.docker.io/token?service=registry.docker.io&scope=repository:$image:pull" | jq --raw-output '.token')"
-								curl -fSL --progress \
+								fetch_blob "https://registry-1.docker.io/v2/$image/blobs/$layerDigest" $token "$dir/$layerTar"
-									-H "Authorization: Bearer $token" \
-									"https://registry-1.docker.io/v2/$image/blobs/$layerDigest" \
-									-o "$dir/$layerTar"
 								;;
 
 							*)
@@ -231,7 +236,8 @@ while [ $# -gt 0 ]; do
 					continue
 				fi
 				token="$(curl -fsSL "https://auth.docker.io/token?service=registry.docker.io&scope=repository:$image:pull" | jq --raw-output '.token')"
-				curl -fSL --progress -H "Authorization: Bearer $token" "https://registry-1.docker.io/v2/$image/blobs/$imageLayer" -o "$dir/$layerId/layer.tar" # -C -
+				# find redirect using token:
+				fetch_blob "https://registry-1.docker.io/v2/$image/blobs/$imageLayer" $token "$dir/$layerId/layer.tar"
 			done
 			;;