build: apply standard Docker image labels (#2400)

Apply Docker image labels standardized in the OCI container image spec.
This improves our ability to trace the provenance of a Contour image
back to the corresponding source code.

Fixes #2392

Signed-off-by: James Peach <[email protected]>

Makefile

@@ -28,6 +28,11 @@ VERSION ?= $(GIT_REF)
 # set outside this Makefile, as a safety valve.
 LATEST_VERSION ?= NOLATEST
 
+# Stash the ISO 8601 date. Note that the GMT offset is missing the :
+# separator, but there doesn't seem to be a way to do that without
+# depending on GNU date.
+ISO_8601_DATE = $(shell TZ=GMT date '+%Y-%m-%dT%R:%S%z')
+
 # Sets the current Git sha
 BUILD_SHA = $(shell git rev-parse --verify HEAD)
 # Sets the current branch
@@ -43,6 +48,23 @@ GO_BUILD_VARS = \
 GO_TAGS := -tags "oidc gcp"
 GO_LDFLAGS := -s -w $(patsubst %,-X %, $(GO_BUILD_VARS))
 
+# Docker labels to be applied to the Contour image. We don't transform
+# this with make because it's not worth pulling the tricks needed to handle
+# the embedded whitespace.
+#
+# See https://github.com/opencontainers/image-spec/blob/master/annotations.md
+DOCKER_BUILD_LABELS = \
+	--label "org.opencontainers.image.created=${ISO_8601_DATE}" \
+	--label "org.opencontainers.image.url=https://projectcontour.io/" \
+	--label "org.opencontainers.image.documentation=https://projectcontour.io/" \
+	--label "org.opencontainers.image.source=https://github.com/projectcontour/contour/archive/${BUILD_VERSION}.tar.gz" \
+	--label "org.opencontainers.image.version=${BUILD_VERSION}" \
+	--label "org.opencontainers.image.revision=${BUILD_SHA}" \
+	--label "org.opencontainers.image.vendor=Project Contour" \
+	--label "org.opencontainers.image.licenses=Apache-2.0" \
+	--label "org.opencontainers.image.title=Contour" \
+	--label "org.opencontainers.image.description=High performance ingress controller for Kubernetes"
+
 export GO111MODULE=on
 
 .PHONY: check
@@ -61,7 +83,13 @@ download: ## Download Go modules
 	go mod download
 
 container: ## Build the Contour container image
-	docker build --build-arg BUILD_VERSION=$(BUILD_VERSION) --build-arg BUILD_BRANCH=$(BUILD_BRANCH) --build-arg BUILD_SHA=$(BUILD_SHA) . -t $(IMAGE):$(VERSION)
+	docker build \
+		--build-arg BUILD_VERSION=$(BUILD_VERSION) \
+		--build-arg BUILD_BRANCH=$(BUILD_BRANCH) \
+		--build-arg BUILD_SHA=$(BUILD_SHA) \
+		$(DOCKER_BUILD_LABELS) \
+		$(shell pwd) \
+		--tag $(IMAGE):$(VERSION)
 
 push: ## Push the Contour container image to the Docker registry
 push: container