github_packages: improve metadata.

[MikeMcQuaid]

• add more metadata to the images on upload
• stitch together images using Docker's CLI
• more code cleanup

Based on #10835 (comment) (and lots of help in Slack) from @sjackman.

Example package: https://github.com/orgs/Homebrew/packages/container/package/homebrew-core%2Flibev

[BrewTestBot]

Review period will end on 2021-03-18 at 15:32:43 UTC.

[BrewTestBot]

Review period skipped due to critical label.

[sjackman]

Nice work, Mike!

Changes addressed.

[MikeMcQuaid]

Thanks for the review @sjackman!

[sjackman]

Annotations currently set

{
"org.opencontainers.image.title"       => "#{formula.full_name} #{package_version} #{bottle_tag}",
"org.opencontainers.image.url"         => formula.homepage,
"org.opencontainers.image.version"     => version,
"org.opencontainers.image.revision"    => git_revision,
"org.opencontainers.image.source"      => "https://github.com/#{org}/#{repo}/blob/#{git_revision}/#{git_path}",
"org.opencontainers.image.created"     => created_time.strftime("%F"),
"org.opencontainers.image.description" => formula.desc,
"org.opencontainers.image.license"     => formula.license,
}

Annotations not set

• org.opencontainers.image.authors contact details of the people or organization responsible for the image (freeform string)
• org.opencontainers.image.documentation URL to get documentation on the image (string)
• org.opencontainers.image.vendor Name of the distributing entity, organization or individual.
• org.opencontainers.image.ref.name Name of the reference for a target (string).

image.authors is typically set to a name and/or e-mail address such as First Last <user@site.com>. We could set it to a Homebrew mailing list, or the author of the formula, or the author of the upstream software (if we had that information, which we don't currently). If anything, I'd suggest either the e-mail address associated with the GitHub organization or the Git Author of last commit to the formula.

image.documentation: We're setting image.url to the formula.homepage. We could set image.documentation to https://formulae.brew.sh/formula/hello

image.vendor should be set to the GitHub organization.

image.ref.name should be set to the package tag, so for example 1.4 for the multi-architecture image and 1.4.x86_64_linux for the single-architecture image. See https://github.com/opencontainers/image-spec/blob/master/image-layout.md#index-example

See https://github.com/opencontainers/image-spec/blob/master/annotations.md#pre-defined-annotation-keys

{
"org.opencontainers.image.authors" => "A Name Or <an@email.address>",
"org.opencontainers.image.documentation" => "https://formulae.brew.sh/formula/#{formula.name}",
"org.opencontainers.image.vendor" => org,
"org.opencontainers.image.ref.name" => "#{package_version}.#{bottle_tag},
}

[sjackman]

skopeo inspect --raw docker://ghcr.io/brewsci/bio/ssm:1.4-x86_64_linux | jq .

{
  "schemaVersion": 2,
  "config": {
    "mediaType": "application/vnd.oci.image.config.v1+json",
    "digest": "sha256:38e6e8b622108194ee99310c23179d26d1c1165d5fe8a28690347dc136cb6b3c",
    "size": 216
  },
  "layers": [
    {
      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
      "digest": "sha256:1b88c88c5b518517046acfe08fd37b382765a7ee7c05d6c24cfdc4e843adb31e",
      "size": 136320,
      "annotations": {
        "org.opencontainers.image.title": "ssm--1.4.x86_64_linux.bottle.tar.gz"
      }
    }
  ],
  "annotations": {
    "org.opencontainers.image.description": "Secondary-structure matching, tool for fast protein structure alignment",
    "org.opencontainers.image.license": "GPL-3.0-only",
    "org.opencontainers.image.revision": "f4b62b94e7a53aef8ec832fc9e1f1c1c00247243fa3d302ebbd21d20ccf75a17b8a9918d2b0801a8",
    "org.opencontainers.image.source": "https://github.com/brewsci/homebrew-bio/blob/f4b62b94e7a53aef8ec832fc9e1f1c1c00247243/Formula/ssm.rb",
    "org.opencontainers.image.title": "brewsci/bio/ssm",
    "org.opencontainers.image.url": "https://www2.mrc-lmb.cam.ac.uk",
    "org.opencontainers.image.version": "1.4"
  }
}

For compatibility with ORAS (the concept and the tool), let’s set the layers[].annotations."org.opencontainers.image.title" to the local bottle filename in the application/vnd.oci.image.manifest.v1+json.