Push latest tag for bottles

[justenstall]

Verification

• This issue's title and/or description do not reference a single formula e.g. brew install wget. If they do, open an issue at https://github.com/Homebrew/homebrew-core/issues/new/choose instead.

Provide a detailed description of the proposed feature

Push latest tag to the homebrew/core/<formula> repository when a new bottle version is created, referencing the new image index.

What is the motivation for the feature?

If the current version of the bottle is tagged latest, the current bottle version can be determined without first downloading an updated formula index.

It is standard practice to create a latest tag when pushing a new release image to a container registry.

How will the feature be relevant to at least 90% of Homebrew users?

This is a step towards being able to install the latest version of a formula without an auto-update or running brew update.

What alternatives to the feature have been considered?

Not implementing the feature.

[MikeMcQuaid]

Thanks for opening @justenstall!

My concern in this case is: how does the consumer validate the checksum of the bottle that is to be downloaded?

[justenstall]

Thanks for opening @justenstall!

No problem :)

My concern in this case is: how does the consumer validate the checksum of the bottle that is to be downloaded?

The checksum of the bottle file is its digest in the container registry, so if the latest tag was used for resolving the file, the digest can be used to verify the file.

The registry's tags aren't currently used to resolve the file, but if they were in the future, then signing the artifacts in the registry would replicate the security guarantees of the signed API JSON (same as the discussion on #17838).

[MikeMcQuaid]

The registry's tags aren't currently used to resolve the file, but if they were in the future, then signing the artifacts in the registry would replicate the security guarantees of the signed API JSON (same as the discussion on #17838).

Gotcha. I'm going to close this issue out and fold discussion into there as this functionality would/should be blocked on having similar signing guarantees.