MCM-09 — Download MCM Installation Package

← Back to MCM Nexus overview

As a Customer User,
I want to download the MCM installation package from Nexus once my subscription is active,
so that I can deploy MCM into my own environment (Self-Hosted MSP Demo or a purchased MSP/Enterprise license).

Acceptance Criteria

• The download action is only available once the Organization has an active license that requires self-hosting (Self-Hosted MSP Demo or a purchased on-prem license); Hosted Enterprise Demo customers do not see this option, since nothing is installed on their side.
• The customer never receives separate registry credentials. The only credential they hold is the MCM App User credential already issued during Subscription Activation — Nexus is the sole holder of the underlying registry credentials, configured by the Nexus Admin in MCM-30 — Registry Configuration for Artifact Delivery.
• The customer can obtain the package two ways:
  • A single wget command authenticated with HTTP Basic Auth using their MCM App User username/password, run directly against a Nexus download endpoint.
  • A "Download" action in the Nexus web portal, while logged in as a normal Customer User — no separate MCM App credential entry required in the portal; Nexus authenticates to the registry internally using the Organization's stored MCM App credential.
• Behind either path, Nexus internally calls the Docker/image registry (the same registry mcm-devops already uses) to fetch the artefact and serves it to the customer — the registry itself is never reached directly by the customer.
• The download delivers the same installer artefact produced by the existing mcm-devops build/publish pipeline — the tarball plus the install.sh entrypoint and supporting etc/ / opt/ layout the installer already expects.
• The customer sees the version they are downloading — always an Approved, non-deprecated version (see MCM-33 — Release Catalog and Version Approval), never one still pending review, rejected, or deprecated — and (once more than one Approved release line exists) can choose which currently-Approved line to install rather than always defaulting silently to the newest.
• A failed or interrupted download can be safely retried without needing to raise a new request.
• The customer's (customer)/license page also shows the version currently installed on their MCM instance, reported by MCM-08 — MCM Instance Subscription Validation's periodic check-in — distinct from the version available to download/upgrade to.

---

Technical Design

GET /api/mcm-app/downloads/package in mcm-nexus/backend accepts either HTTP Basic Auth with the MCM App User's credentials (the documented wget command) or the customer's normal portal session, and is the only party that ever authenticates to the registry directly — using the Nexus-Admin-configured credentials from MCM-30 — Registry Configuration for Artifact Delivery, so the registry's own credentials are never issued to the customer. This is the same "centralize what's common" pattern as MCM-11 — Shared Email API, applied to registry credentials instead of email, and it reads from the same versioned artefact set produced by mcm-devops that MCM-10 — Instance Upgrade reads from — one definition of "what version exists," not a separate one for install versus upgrade. Both stories resolve "the version to serve" against MCM-33's Release table, filtered to status=APPROVED (excluding DEPRECATED), not simply the newest artefact the registry happens to hold. A failed or interrupted download can be retried from the same (customer)/license page, or by re-running the same wget command, without raising a new request.

---

UI / Frontend Changes

• (customer)/license: new "Download" action, visible only once the Organization has an active self-hosted license (hidden entirely for Hosted Enterprise Demo customers).
• Displays the version being downloaded (an Approved, non-deprecated release), and once multiple Approved release lines exist, a way to choose which one to install instead of always defaulting to the newest.
• Also displays the version currently installed on the customer's MCM instance, separate from the downloadable version above.
• Documented wget command shown alongside the portal download button, for customers who prefer the CLI path.
• Retry affordance on a failed/interrupted download — same page, no need to raise a new request.
• No registry credential entry field anywhere in the portal — the only credential the customer ever sees is their MCM App username/password.