List tags and resolve a tag to a manifest digest for a Docker Hub image via the Registry HTTP API v2 (token auth, Accept headers, Docker-Content-Digest)

Documented steps

1. Get an anonymous pull-scoped Bearer token from Docker Hub's auth service: TOKEN=$(curl -s "https://auth.docker.io/token?service=registry.docker.io&scope=repository:library/alpine:pull" | python3 -c "import sys,json;print(json.load(sys.stdin)['token'])")
2. List all tags for the repo: curl -s -H "Authorization: Bearer $TOKEN" https://registry-1.docker.io/v2/library/alpine/tags/list
3. List tags with pagination using the n and last query params (GET /v2/<name>/tags/list?n=<integer>&last=<tagname>): curl -s -D - -H "Authorization: Bearer $TOKEN" "https://registry-1.docker.io/v2/library/alpine/tags/list?n=5" — the response includes a Link: <url?n=5&last=LASTTAG>; rel="next" header (RFC5988) to follow for the next page; keep paging until no Link header is returned
4. Fetch the next page using the last value taken from the previous Link header: curl -s -H "Authorization: Bearer $TOKEN" "https://registry-1.docker.io/v2/library/alpine/tags/list?n=5&last=<last-tag-from-previous-page>"
5. HEAD the manifest for a tag, sending Accept for all four current manifest media types so multi-arch images resolve to the top-level index/list rather than erroring: curl -sI -H "Authorization: Bearer $TOKEN" -H "Accept: application/vnd.oci.image.index.v1+json, application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.docker.distribution.manifest.v2+json" https://registry-1.docker.io/v2/library/alpine/manifests/latest
6. Read the resolved digest from the Docker-Content-Digest response header (e.g. content-type: application/vnd.oci.image.index.v1+json, docker-content-digest: sha256:...).
7. GET (not HEAD) the same reference to read the JSON body when you need the list of per-platform manifests and their own digests: curl -s -H "Authorization: Bearer $TOKEN" -H "Accept: application/vnd.oci.image.index.v1+json" https://registry-1.docker.io/v2/library/alpine/manifests/latest | python3 -m json.tool
8. Resolve a single platform's manifest by re-requesting with that platform's digest as the reference: curl -sI -H "Authorization: Bearer $TOKEN" -H "Accept: application/vnd.oci.image.manifest.v1+json" https://registry-1.docker.io/v2/library/alpine/manifests/<per-platform-digest>
9. Docs: https://github.com/opencontainers/distribution-spec/blob/main/spec.md ; https://distribution.github.io/distribution/spec/api/ ; https://distribution.github.io/distribution/spec/auth/token/