def METHOD_NAME(self, checksum, desc):
    image_id = checksum
    image = desc["image"]
    imagename = image["name"]
    digest = image["digest"]
    tls_verify = image.get("tls-verify", True)
    with tempfile.TemporaryDirectory(prefix="tmp-download-", dir=self.cache) as tmpdir:
        archive_dir = os.path.join(tmpdir, "container-archive")
        os.makedirs(archive_dir)
        os.chmod(archive_dir, 0o755)
        source = f"docker://{imagename}@{digest}"
        # We use the dir format because it is the most powerful in terms of feature support and is the closest to a
        # direct serialisation of the registry data.
        destination = f"dir:{archive_dir}/{self.dir_name}"
        extra_args = []
        if not tls_verify:
            extra_args.append("--src-tls-verify=false")
        subprocess.run(["skopeo", "copy"] + extra_args + [source, destination],
                       encoding="utf-8",
                       check=True)
        # Verify that the digest supplied downloaded the correct container image id.
        # The image id is the digest of the config, but skopeo can't currently
        # get the config id, only the full config, so we checksum it ourselves.
        res = subprocess.check_output(["skopeo", "inspect", "--raw", "--config", destination])
        downloaded_id = "sha256:" + hashlib.sha256(res).hexdigest()
        if downloaded_id != image_id:
            raise RuntimeError(
                f"Downloaded image {imagename}@{digest} has a id of {downloaded_id}, but expected {image_id}")
        # Atomically move download archive into place on successful download
        with ctx.suppress_oserror(errno.ENOTEMPTY, errno.EEXIST):
            os.makedirs(os.path.join(self.cache, image_id), exist_ok=True)
            os.rename(os.path.join(archive_dir, self.dir_name), os.path.join(self.cache, image_id, self.dir_name))