Add --digestfile support to buildah source push

[arewm]

Description

When using buildah source push, I would like to know what the digest of the OCI artifact pushed is such that I can reference the artifact by digest instead of tag.

In order to ensure that the content of a source is not tampered with, the best practice is to use digest references as the digest is sensitive to any changes in the underlying tarballs. In the absence of knowing what the digest of the artifact is at push time, the process for getting the digest value would be something like:

• Push the source artifact to the registry
• Query for the digest of the artifact in the remote registry
• Pull the artifact from the remote registry by digest
• Check the integrity of the artifact against the local filesystem

Another potential option would be to use Skopeo to push the artifact

$ buildah source create /tmp/source-image
$ buildah source add /tmp/source-image /foo/bar
$ buildah source add /tmp/source-image /foo/baz
$ skopeo copy --digestfile digestfile.local oci:/tmp/source-image docker://quay.io/foobar/baz-source

But this would not work well if running from within a single Tekton task from a container that only has buildah.