curl Xcode

xcode-curl.sh

#!/bin/bash

# Useful for downloading Xcode on machines where you don't want to log-in with your Apple ID (e.g. CI 
# machines, or other low-trust environemnts).
# Requires you to manually log-in to the Apple Dev Portal, and extract contents of the ADCDownloadAuth cookie 
# (easiest way to do it is using Web Inspector, going to the "Storage" Pane, selecting "Cookies" in the left sidebar, 
# and copying the appropriate value.
#
# Usage:
# curl https://gist.githubusercontent.com/jklausa/5780d5126d97f73b70a91aeab58f7f4a/raw/ | bash -s -- XCODE-URL COOKIE_VALUE 
# e.g.
# curl https://gist.githubusercontent.com/jklausa/5780d5126d97f73b70a91aeab58f7f4a/raw/ | bash -s -- https://download.developer.apple.com/Developer_Tools/Xcode_12.5.1/Xcode_12.5.1.xip ThIsIsNotARealCoOkiEJusTanExample 
#
# Based on https://gist.github.com/iandundas/fabe07455e5216442a421922361f698c#gistcomment-3721309, 
# rewritten to use just plain curl; so it's runnable on vanilla macOS installs.

set -e
set -u

exec curl \
   --cookie ADCDownloadAuth=$2 \
   --remote-name \
   "$1"

I was trying Xcode 13.3.1, but I just figured out why I was needing the extra cookie value:

I was copy/pasting in the URL I got from the rendered HTML links off of xcodereleases.com, like: https://developer.apple.com/services-account/download?path=/Developer_Tools/Xcode_13.3.1/Xcode_13.3.1.xip. It looks like these URLs do need the myacinfo cookie, but the simpler URLs like the one from this script's comments work with just ADCDownloadAuth like you just confirmed.

When I looked again at my Chrome network log from downloading Xcode from ADC, it does indeed use the shorter URL, and so does the data JSON from xcodereleases. Maybe those other URLs at /services-account/download are there to help redirect the user through the sign-in flow?

Anyway, mystery solved!