[wasm-metadata] support OCI annotations

[yoshuawuyts]

Description

During a BA Packaging SG meeting earlier this year we discussed adopting support for OCI Annotations Spec-compatible metadata for Wasm Components. The idea is that language-tools like cargo-component can read metadata from e.g. Cargo.toml and encode it as custom sections in Wasm. And then tools like wkg can read those custom sections, and encode them into the OCI images in the correct locations. This makes it so that adding component metadata into registries is something that just happens automatically.

Currently wasm-metadata includes support for something called RegistryMetadata. This is encoded in Wasm binaries as a section named registry-metadata and stored as JSON. In the Packaging SG meeting we decided to deprecate this approach and instead replace it with a custom section per field.

Because we are designing this with the express goal of being compatible with the OCI Annotations Spec, the value encodings must be compatible. We do however have liberty over the names of the custom sections, and we can define the mappings between Wasm and OCI in the Wasm OCI specification.

I'm opening this issue to explain what the current plan for this is before opening up any PRs that implement this. My current plan for this is as follows:

1. Remove support for RegistryMetadata from wasm modules
2. Replace RegistryMetadata with dedicated custom sections for components
3. Add support for any remaining custom sections
4. Document these sections in wasm-tool-conventions
5. Document these sections in the Wasm OCI Spec

I hope this all makes sense. Happy to answer questions if anyone has any. Thanks!

Tasks

The following sections would need to be encoded to fully match the OCI Annotations Spec:

• author
• description custom section (supported by GitHub packages)
• licenses custom section (supported by GitHub packages)
• source custom section (supported by GitHub packages)
• homepage custom section
• version custom section
• revision custom section
• created custom section

References

• Metadata for WASI OCI artifacts WebAssembly/WASI#608
• Enable generating OpenContainers annotations from Wasm Components WebAssembly/tool-conventions#230

[yoshuawuyts]

I'm actually having some reservations about including created in a custom section. I for one like reproducible builds, and I believe that might run directly counter to it.

It might be fine to include in the final OCI binary if inserted by another tool (e.g. wkg), but maybe we shouldn't create a place to store it in the .wasm binary?

[yoshuawuyts]

Oh actually, @bjorn3 just pointed out that the timestamp can be set - as long as it's hard-coded to the time of e.g. the last commit (ref).

Okay, yeah, that could work! We might want to consider supporting that then, and just ensure in upstream tooling that the timestamp is correctly set.