Docker push: ability to get the digest

Description

As part of attestation and security, I would like to push an image and immediately get the sha256 digest.

When I push the image with docker push <tag> the digest is shown:

The push refers to repository [kristofmattei/foobar:my-awesome-tag]
da39f46fb7a8: Waiting
da39f46fb7a8: Layer already exists
...
4f4fb700ef54: Waiting
4f4fb700ef54: Layer already exists
my-awesome-tag: digest: sha256:d67fed5e2a846838ace975a96fd1a53e3fbe7fe60d95a8019e3003c295643a07 size: 1043

But using --quiet the the digest itself disappears too:

kristofmattei/foobar:my-awesome-tag

Once this is done I can do docker image inspect kristofmattei/foobar:my-awesome-tag to get the digest.

However I might be pushing multiple images, and in order to avoid any bugs when I accidentally push 2 images with the same tags but different digests, I'd like to get the digest directly from the push (both digests are valid, for example in the case of multi-platform images).

That way I can merge the images together later.

Is there another way to get the digest from the push, other than capture & filter the output?

Start by tracing the docker push --quiet entry point and compare it with the normal push output, which includes the image digest. Determine the intended quiet-mode digest result, then add coverage showing that pushes expose the digest without requiring output capture and filtering.