Inject package_metadata into module repos

[fmeum]

RELNOTES: Bazel modules from a registry that don't include a REPO.bazel file now automatically have a package_metadata target with their PURL injected and registered as the default for all targets in the module repo. Any module that is patched locally via a single_version_override will receive a deterministic version modifier that is unique on best-effort basis.

[fmeum]

FYI @mzeren-vmw @Yannic

[meteorcloudy]

Does the PURL fragment already provide license info?

FYI @kotlaja this might be useful for the GDC Bzlmod migration.

[fmeum]

Does the PURL fragment already provide license info?

It doesn't, but it uniquely identifies the source for that info. My personal opinion is that "Bazel module <-> Bazel PURL" is a trivial one-to-one mapping and "Bazel module -> license" is a function that can only be evaluated by a lawyer, so it makes sense to automate the "Bazel module -> PURL" part and let users figure out the "PURL -> license" part, perhaps even out of band.

[aiuto]

It doesn't, but it uniquely identifies the source for that info. My personal opinion is that "Bazel module <-> Bazel PURL" is a trivial one-to-one mapping

Well.. not really. Because with module overrides, you can get local patches which make my code labeled as purl=x different from your code labeled as purl=X. PURL's are like any other URL, they are sort of a hint more than anything precise.
OTOH, we recognize this in the supply chain tools and will let you override licenses and other attestations by purl or target.

[meteorcloudy]

@fweikert Please also take a look

[fmeum]

I can send a followup pr to address @aiuto's concern: In the case of a single_version_override, we can append a hash of all patches to the version number as a new segment. This ensures that patches are always visible on the SBOM level.

[fmeum]

@bazel-io fork 9.0.0

[meteorcloudy]

@fmeum We have some test failures on RBE during import: https://buildkite.com/bazel/google-bazel-presubmit/builds/98041

Maybe try to rebase to HEAD and see if it reproduce on the PR?

[fmeum]

I will take a look and address @aiuto's comment along the way.

[meteorcloudy]

Oh, postsubmit is red since https://buildkite.com/bazel/bazel-bazel/builds/34042

[meteorcloudy]

postsubmit is due to some RBE infra change, we are fixing it.

[fmeum]

@aiuto Could you take another look? I hope I addressed your concern.