Improve kpt CLI distribution: homebrew-core and publish deb/rpm packages

[aravindtga]

Summary

kpt v1.0.0 is released now, but the CLI is only distributed through a limited set of channels. This issue proposes a phased plan to make kpt easier to install across common package managers.

Current state

kpt v1.0.0 is published to:

• GitHub Releases - raw binaries + .tar.gz archives (darwin/linux & amd64/arm64), checksums.txt, and SLSA3 provenance (multiple.intoto.jsonl).
• GHCR container image - ghcr.io/kptdev/kpt:v1.0.0 (multi-arch).
• Homebrew via a self-hosted tap - brew tap kptdev/kpt ... && brew install kpt, using Formula/kpt.rb in this repo.
• go install github.com/kptdev/kpt@main - source build.

Not available today (no publishing config in the repo): homebrew-core, deb/apt, rpm/yum, snap, and Windows package managers (Scoop/winget/Chocolatey).

Problems with the current Homebrew tap

The self-hosted tap works, but has ongoing downsides:

• Manual, drift-prone maintenance. No workflow runs release/formula/main.go; the formula must be bumped by a hand-crafted PR every release. Because it is manual, it regularly lags behind the latest release.
• Builds from source. The formula uses depends_on "go" => :build and runs go build, so every install requires a Go toolchain and a full compile - slower and heavier than a prebuilt binary, and reports a build-derived version.
• Discoverability. Users must know the tap URL (brew tap kptdev/kpt https://github.com/kptdev/kpt.git) before brew install kpt works; there is no plain brew install kpt.

No Linux package artifacts

Users on Debian/Ubuntu/RHEL/Fedora have no .deb/.rpm to install; they must download raw binaries manually.

How 'kubectl' handles this?

• Homebrew: kubectl ships via homebrew-core (kubernetes-cli), i.e. brew install kubectl with no tap.
• Linux packages: kubectl goes further than this proposal - it runs hosted, GPG-signed, per-minor-version apt/yum repositories (pkgs.k8s.io) enabling apt-get install kubectl / yum install kubectl. That corresponds to the "hosted signed repos" item under Out of scope here. Phase 3 intentionally starts smaller (packages attached to the GitHub release), hosted repos can follow if there is demand.

Proposed plan (phased)

Phase 1 - Submit kpt to homebrew-core

• Open a formula PR to Homebrew/homebrew-core (external process; acceptance is subject to Homebrew's notability/maintenance criteria and maintainer review).
• homebrew-core ships prebuilt bottles and auto-bumps new versions via BrewTestBot (typically discovered within ~a day of a stable tag; end-to-end propagation takes some time).
• Do not remove the local tap until homebrew-core is merged AND brew install kpt is verified working from core. Keep the tap as a fallback during the transition.

Phase 2 - Remove the self-hosted tap (only after Phase 1 is verified live)

Coordinated cleanup - remove the whole tap toolchain, not just the .rb:

• Formula/kpt.rb, Formula/README.md
• release/formula/main.go, release/formula/main_test.go, release/formula/README.md
• Update the Homebrew section in
  documentation/content/en/installation/kpt-cli.md(brew tap ... && brew install kpt -> brew install kpt).
• Update the Homebrew references in AGENTS.md.

Phase 3 - Publish deb/rpm (and apk) via GoReleaser

• Add an nfpms: block to release/tag/goreleaser.yaml to build .deb, .rpm (and optionally .apk) from the existing linux amd64/arm64 binaries and attach them to the GitHub release.
• Note: artifacts are only published on the next v[1-9].*.* tag push. This is forward-only - v1.0.0 will not retroactively gain these assets.
• Scope: this provides downloadable packages (dpkg -i / rpm -i). It does not provide apt-get install kpt / yum install kpt, which would require a separately hosted, GPG-signed repository

Out of scope (Proposed)

• Hosted, signed apt/yum repositories
• Snapcraft
• Windows package managers