rh-download-blob.sh

#!/bin/bash

# rh-download-blob
# Downloads a blob path from a Red Hat Container Registry location, using a username/password combo

# Input your username or service account and password/token.
USERNAME="username"
PASSWORD="password"

# Change this to the required blob location (SHA256 path)
RH_BLOB="https://registry.redhat.io/v2/ubi9/ubi/blobs/sha256:f5e6502d2728ac70bea5ebf27077abc1ccfcc4b6601b93055132a1559bac5151"
########################################
RH_ENDPOINT="https://registry.redhat.io:443"
ACCESS_TOKEN=""

function log() {
        echo "[$(date +"%Y-%m-%d %T")]: ${1}"
}

function endf() {
        echo "=============================="
}


function basic_http_login() {
        log "Attempting Basic Authorization Login Method..."
        TOKEN=$(echo -n ${USERNAME}:${PASSWORD} | base64 | tr -d '\n')
        ACCESS_TOKEN=$(curl -k \
             -H "Authorization: Basic ${TOKEN}" \
             -H "Accept-Encoding: gzip" \
             -H "Docker-Distribution-Api-Version: registry/2.0" \
             -G "${RH_ENDPOINT}/auth/realms/rhcc/protocol/redhat-docker-v2/auth" \
             --data-urlencode "account=${USERNAME}" \
             --data-urlencode "service=docker-registry" \
             | jq '.access_token')
        if [ -z "$ACCESS_TOKEN" ]; then
                log "Access token acquisition failed."
                exit
        else
                ACCESS_TOKEN=$(echo $ACCESS_TOKEN | tr -d '"')
                log "Acquired access token $ACCESS_TOKEN"
        fi
        endf
}

function do_get_on_blob() {
        log "Performing full GET on blob location at \"${RH_BLOB}\"..."
        curl -k -L -v \
                -H "Authorization: Bearer ${ACCESS_TOKEN}" \
                -G "${RH_BLOB}" \
                --output "blob-$(date +"%Y-%m-%d-%T")"
        endf
}

function main() {
        basic_http_login
        do_get_on_blob
}

main

You don't need the Accept-encoding and the Docker-Distribution-Api-Version headers anymore for the auth endpoint, it always returns application/json. For manifest download, you'd need several Accept headers though.