Generating metadata for OCI packages

[yoshuawuyts]

I filed WebAssembly/WASI#608 because I noticed wasi:[email protected] was missing some useful metadata ghcr likes to ingest. Maybe this is something to ask the tag runtime group in the CNCF,- but I figured I should also ask it here: Are opencontainer's pre-defined annotation keys what we want to support to encode additional metadata in the OCI images?

On the one hand this seems fairly harmless since it really is just metadata intended for the registry. On the other hand: I don't know if there is another way we could potentially want to encode this metadata in the image, and it's something that technically isn't part of the original .wasm binary.

I figured I should ask here since "encoding metadata" feels like it intersects with package tooling too. And I assume for language-native guest tooling, we'd probably want to e.g. read SPDX license or description info from manifest files (e.g. Cargo.toml, package.json) and write that out to the OCI image. Which in turn probably will need to be supported by wasm-pkg-tools as well.

Anyway, keen to hear folks thoughts about this!

[lann]

There is also a package metadata custom section: https://docs.rs/wasm-metadata/latest/wasm_metadata/struct.RegistryMetadata.html