Allow podman-remote push to accept the --digestfile flag

[cooktheryan]

Feature request description

When using Tekton Chains to sign images generated through Tekton the outputs of Image_digest and Image URL are used by Tekton chains to generate attestation and to cosign the images. When using podman-remote especially when accessing a build server to build and push the process can be completed successfully but I cannot gain the digest information without doing a work around like scp or another back to the Tekton task.

Suggest potential solution

If we were to enable the flag to record the sha and write it to the system running podman-remote the problem would be resolved. I'm unsure if it could be grabbed from stdout of the podman-remote push.

Have you considered any alternatives?

Using podman-remote save to save the image to the pipeline allows for a potential breach of trust.

Additional context

This could be incredibly helpful for GitHub actions as well as Tekton/Tekton chains to build different architectures without needing a full kubernetes cluster of that architecture just a single VM

[vrothberg]

Thanks for reaching out, @cooktheryan.

I think that's doable for the remote client. The push REST endpoint is streaming to the client, so I guess we could transport the digest in the http.Response.Trailer.

@mtrmac WDYT?

[mtrmac]

The primary way to deal with signing pushed content should be podman push --sign-by-sigstore*, so that users don’t need to correctly handle the digest references — but that doesn’t currently work for remote either, and it’s not very clear whether it’s acceptable to send the private key material to the remote server.

Either way, implementing --digestfile for remote would be an improvement.

---

My intuitive first guess for how this can be done is be to add a new kind of entry to the body’s ImagePushReport, instead of using trailers (which are not used anywhere else in the codebase?), but that’s an implementation detail I feel very weakly about.

[cooktheryan]

thanks @mtrmac it's an interesting scenario. We are trying to avoid needing to use the local podman commands because we are launching instances with terraform with a specific architecture allowing for us to quickly build with podman-remote versus trying to use the qemu functionality.

Really appreciate yall discussing this so quickly

[vrothberg]

Opened #18284 to add support.