Add package_metadata target

[Yannic]

@package_metadata is the successor to @rules_license.

[Yannic]

cc @TheGrizzlyDev, @aiuto, @mzeren-vmw, @fweikert

[tonyaiuto]

I don't like this approach. We should allow package_metadata to accept the old license as an attribute and have the gathering tool take either.

[aiuto]

We should try this in a few large repositories.

[gregestren]

I don't like this approach. We should allow package_metadata to accept the old license as an attribute and have the gathering tool take either.

@aiuto is this still a concern for you?

@Yannic What's the current end-to-end expected outcome? i.e. are you just trying to update this as best practice, or are there more concrete use cases you're trying to support now? How many repos need to be updated to make those use cases practical? I believe @package_metadata is still a beta version: is the API stable enough now for intended use cases?

[Yannic]

@gregestren The API of the package_metadata and license rules is sufficiently stable at this point to start adding it to modules. Gazelle and a few others already use it in a similar way as this PR introduces.

The supply-chain working group is currently working on the tooling, aspects, ... to collect all the metadata and produce an SBOM. There's a prototype, but nothing finished yet. Because of that, the inner details of providers may still change a bit depending on feedback from SBOM generation, but that won't affect users of the rules to declare package metadata.

Our current milestone is to get an end-to-end SBOM working for a large-ish project (Selenium), so we're adding metadata to its dependencies to make this project practical. Modules like platforms also can serve as example and best-practice for adding it to all modules in BCR

[gregestren]

Thanks for the explanation.

It sounds okay to me. @fweikert did you have any other input? I'm happy to merge otherwise.

[fweikert]

@gregestren no objections from my side. @Yannic thank you for your work!

[gregestren]

@Yannic should we roll a release out of this or wait for further changes?

[tonyaiuto]

I don't see a need to rush a release. We'll probably bump again in a week.

[Yannic]

No need to rush. But also no need to delay a release on us if you have something lined up