discovery: do not set version to latest if not provided

Actually, if the required discovery labels doesn't contain a version
label, it'll be set to a default of "latest". This behavior isn't
documented in the spec and can create unwanted behaviors.

This patch removes this and also adds to the spec an example on how to
obtain the latest behavior without this "hidden" default.

discovery/discovery.go

@@ -49,10 +49,6 @@ type ACIEndpoints []ACIEndpoint
 
 type PublicKeys []string
 
-const (
-	defaultVersion = "latest"
-)
-
 var (
 	templateExpression = regexp.MustCompile(`{.*?}`)
 	errEnough          = errors.New("enough discovery information found")
@@ -134,9 +130,6 @@ func createTemplateVars(app App) []string {
 
 func doDiscover(pre string, hostHeaders map[string]http.Header, app App, insecure InsecureOption) (*discoveryData, error) {
 	app = *app.Copy()
-	if app.Labels["version"] == "" {
-		app.Labels["version"] = defaultVersion
-	}
 
 	_, body, err := httpsOrHTTP(pre, hostHeaders, insecure)
 	if err != nil {

discovery/discovery_test.go

@@ -402,8 +402,7 @@ func TestDiscoverEndpoints(t *testing.T) {
 			[]string{"https://example.com/pubkeys.gpg"},
 			nil,
 		},
-		// Test missing labels. version label should default to
-		// "latest" and the first template should be rendered
+		// Test missing labels. No template will render
 		{
 			&mockHTTPDoer{
 				doer: fakeHTTPGet(
@@ -415,18 +414,13 @@ func TestDiscoverEndpoints(t *testing.T) {
 					nil,
 				),
 			},
-			true,
+			false,
 			true,
 			App{
 				Name:   "example.com/myapp",
 				Labels: map[types.ACIdentifier]string{},
 			},
-			[]ACIEndpoint{
-				ACIEndpoint{
-					ACI: "https://storage.example.com/example.com/myapp-latest.aci",
-					ASC: "https://storage.example.com/example.com/myapp-latest.aci.asc",
-				},
-			},
+			[]ACIEndpoint{},
 			[]string{"https://example.com/pubkeys.gpg"},
 			nil,
 		},

spec/discovery.md

@@ -107,3 +107,19 @@ Authentication during the discovery process is optional.
 If an attempt at fetching any resource (the initial discovery URL, an App Container Image, or signature) returns a `401 Unauthorized`, implementations should enact the authentication policy set by the operator.
 For example, some implementations might only perform HTTP basic authentication over HTTPS connections.
 
+
+### Examples
+
+#### Latest pattern
+
+If a client wants to retrieve the latest available ACI (without knowing its version) it can provide these meta tags:
+
+```html
+<meta name="ac-discovery" content="example.com https://storage.example.com/{os}/{arch}/{name}-{version}.{ext}">
+<meta name="ac-discovery" content="example.com https://storage.example.com/{os}/{arch}/{name}-latest.{ext}">
+```
+
+When requiring a specific version, the first template will be rendered, when not requiring a _version_ label the second template will match.
+
+On the http server, the "latest" url should point to the current latest ACI.
+