dAppCDN for Institutions

{
  "project": {
    "slug": "example-app",
    "name": "Example App",
    "url": "https://dappcdn.com/download/utilities/example-app",
    "release": {
      "id": "00000000-0000-4000-8000-000000000002",
      "version": "2.0.0",
      "files": [
        {
          "id": "00000000-0000-4000-8000-000000000001",
          "name": "example-app-2.0.0-setup.exe",
          "label": "Windows installer",
          "os": "windows",
          "size": 12582912,
          "hash": { "md5": "...", "sha1": "...", "sha256": "..." },
          "scanned": true,
          "available": true,
          "download_url": "https://dappcdn.com/api/institutions/v1/projects/example-app/files/00000000-0000-4000-8000-000000000001"
        }
      ]
    }
  }
}

#!/usr/bin/env bash
set -euo pipefail

# The latest release of one app
curl -fsS -H "Authorization: Bearer $DAPPCDN_KEY" \
  https://dappcdn.com/api/institutions/v1/projects/example-app

# Its Linux file, saved under its own name and checked against the published SHA-256
{ read -r NAME; read -r URL; read -r SHA256; } < <(
  curl -fsS -H "Authorization: Bearer $DAPPCDN_KEY" https://dappcdn.com/api/institutions/v1/projects/example-app \
    | jq -r '([.project.release.files[] | select(.os == "linux")][0] // {})
             | (.name // ""), (.download_url // ""), (.hash.sha256 // "")'
)
if [ -z "$URL" ]; then echo "No Linux file in the latest release" >&2; exit 1; fi
curl -fL -H "Authorization: Bearer $DAPPCDN_KEY" -o "$NAME" "$URL"
if [ -n "$SHA256" ]; then echo "$SHA256  $NAME" | sha256sum -c -; fi

# Intune (Win32 app), Configuration Manager, PDQ Deploy or a scheduled task
# Windows PowerShell 5.1 or PowerShell 7
[Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
$headers = @{ Authorization = "Bearer $env:DAPPCDN_KEY" }
$answer  = Invoke-RestMethod -Uri 'https://dappcdn.com/api/institutions/v1/projects/example-app' -Headers $headers
$file    = $answer.project.release.files | Where-Object { $_.os -eq 'windows' } | Select-Object -First 1
if (-not $file) { throw 'No Windows file in the latest release' }

Write-Output "Latest version: $($answer.project.release.version)"
Invoke-WebRequest -Uri $file.download_url -Headers $headers -OutFile $file.name -UseBasicParsing

if ($file.hash.sha256 -and (Get-FileHash $file.name -Algorithm SHA256).Hash -ne $file.hash.sha256) {
    throw "Checksum mismatch for $($file.name)"
}

# ExampleApp.download.recipe.yaml
# DAPPCDN_KEY comes from your AutoPkg preferences or the command line, never from the recipe:
#   defaults write com.github.autopkg DAPPCDN_KEY "<key>"
#   autopkg run ExampleApp.download.recipe.yaml -k DAPPCDN_KEY="<key>"
Description: Downloads the latest macOS release of Example App from dAppCDN.
Identifier: com.example.autopkg.download.ExampleApp
MinimumVersion: '2.3'
Input:
  NAME: ExampleApp
  SLUG: example-app
Process:
  - Processor: URLTextSearcher
    Arguments:
      url: https://dappcdn.com/api/institutions/v1/projects/%SLUG%
      request_headers:
        Authorization: Bearer %DAPPCDN_KEY%
      re_pattern: '"version":"(?P<version>[^"]+)"'
  - Processor: URLTextSearcher
    Arguments:
      url: https://dappcdn.com/api/institutions/v1/projects/%SLUG%
      request_headers:
        Authorization: Bearer %DAPPCDN_KEY%
      re_pattern: '"name":"[^"]+\.dmg".*?"download_url":"(?P<download_url>[^"]+)"'
  - Processor: URLDownloader
    Arguments:
      url: '%download_url%'
      request_headers:
        Authorization: Bearer %DAPPCDN_KEY%
      filename: '%NAME%-%version%.dmg'
  - Processor: EndOfCheckPhase

# dappcdn_key: kept in Ansible Vault
- name: Read the latest release of Example App
  ansible.builtin.uri:
    url: https://dappcdn.com/api/institutions/v1/projects/example-app
    headers:
      Authorization: "Bearer {{ dappcdn_key }}"
    return_content: true
  register: dappcdn

- name: Pick its Linux file
  ansible.builtin.set_fact:
    dappcdn_file: "{{ dappcdn.json.project.release.files | selectattr('os', 'equalto', 'linux') | first }}"

- name: See whether this version is already there
  ansible.builtin.stat:
    path: "/opt/packages/{{ dappcdn_file.name }}"
    checksum_algorithm: sha256
  register: dappcdn_local

# The key goes to dAppCDN only: get_url would also send it to the CDN behind the redirect
- name: Get the file's short-lived download link
  when: not (dappcdn_local.stat.exists and dappcdn_local.stat.checksum == dappcdn_file.hash.sha256)
  ansible.builtin.uri:
    url: "{{ dappcdn_file.download_url }}"
    headers:
      Authorization: "Bearer {{ dappcdn_key }}"
    follow_redirects: none
    status_code: 302
  register: dappcdn_link

- name: Download it, checked against the published SHA-256
  when: dappcdn_link is not skipped
  ansible.builtin.get_url:
    url: "{{ dappcdn_link.location }}"
    dest: "/opt/packages/{{ dappcdn_file.name }}"
    checksum: "{{ ('sha256:' + dappcdn_file.hash.sha256) if dappcdn_file.hash.sha256 else omit }}"