Inject package_metadata into module repos

MODULE.bazel

@@ -53,6 +53,7 @@ bazel_dep(name = "remoteapis", version = "")
 
 # Indirect module dependencies. Minimal versions are specified for compatibility; repo_name=None avoids accidental usages
 bazel_dep(name = "buildozer", version = "8.2.1", repo_name = None)  # Keep in sync with MODULE.tools
+bazel_dep(name = "package_metadata", version = "0.0.7", repo_name = None)  # Keep in sync with MODULE.tools
 bazel_dep(name = "rules_swift", version = "3.3.0")  # with repo_name = None, version drops to 2.4.0
 bazel_dep(name = "rules_apple", version = "4.3.1", repo_name = None)
 bazel_dep(name = "google_benchmark", version = "1.9.4", repo_name = None)

repositories.bzl

@@ -39,6 +39,7 @@ DIST_ARCHIVE_REPOS = [
     "grpc+",
     "grpc-java+",
     "opencensus-cpp+",
+    "package_metadata",
     "platforms",
     "protobuf+",
     "protoc-gen-validate+",

src/MODULE.tools

@@ -7,6 +7,7 @@ module(name = "bazel_tools")
 bazel_dep(name = "rules_license", version = "1.0.0")
 
 bazel_dep(name = "buildozer", version = "8.2.1")
+bazel_dep(name = "package_metadata", version = "0.0.7")
 bazel_dep(name = "platforms", version = "1.0.0")
 bazel_dep(name = "zlib", version = "1.3.1.bcr.5")
 

src/main/java/com/google/devtools/build/lib/bazel/bzlmod/ArchiveRepoSpecBuilder.java

@@ -22,6 +22,7 @@
 import com.google.devtools.build.lib.cmdline.Label;
 import com.google.errorprone.annotations.CanIgnoreReturnValue;
 import java.util.List;
+import java.util.Map;
 import net.starlark.java.eval.Dict;
 import net.starlark.java.eval.StarlarkInt;
 import net.starlark.java.eval.StarlarkList;
@@ -59,12 +60,6 @@ public ArchiveRepoSpecBuilder setStripPrefix(String stripPrefix) {
     return this;
   }
 
-  @CanIgnoreReturnValue
-  public ArchiveRepoSpecBuilder setPatches(ImmutableList<Label> patches) {
-    attrBuilder.put("patches", StarlarkList.immutableCopyOf(patches));
-    return this;
-  }
-
   @CanIgnoreReturnValue
   public ArchiveRepoSpecBuilder setRemotePatches(ImmutableMap<String, String> remotePatches) {
     attrBuilder.put("remote_patches", Dict.immutableCopyOf(remotePatches));
@@ -88,6 +83,12 @@ public ArchiveRepoSpecBuilder setRemoteModuleFile(RemoteFile remoteModuleFile) {
     return this;
   }
 
+  @CanIgnoreReturnValue
+  public ArchiveRepoSpecBuilder setPurlFragments(Map<String, String> purlFragments) {
+    attrBuilder.put("purl_fragments", Dict.immutableCopyOf(purlFragments));
+    return this;
+  }
+
   @CanIgnoreReturnValue
   public ArchiveRepoSpecBuilder setRemotePatchStrip(int remotePatchStrip) {
     attrBuilder.put("remote_patch_strip", StarlarkInt.of(remotePatchStrip));

src/main/java/com/google/devtools/build/lib/bazel/bzlmod/GitRepoSpecBuilder.java

@@ -18,6 +18,7 @@
 import com.google.devtools.build.lib.cmdline.Label;
 import com.google.errorprone.annotations.CanIgnoreReturnValue;
 import java.util.List;
+import java.util.Map;
 import net.starlark.java.eval.Dict;
 import net.starlark.java.eval.StarlarkList;
 
@@ -81,6 +82,12 @@ public GitRepoSpecBuilder setRemoteModuleFile(
     return this;
   }
 
+  @CanIgnoreReturnValue
+  public GitRepoSpecBuilder setPurlFragments(Map<String, String> purlFragments) {
+    attrBuilder.put("purl_fragments", Dict.immutableCopyOf(purlFragments));
+    return this;
+  }
+
   public RepoSpec build() {
     return new RepoSpec(GIT_REPOSITORY, AttributeValues.create(attrBuilder.buildImmutable()));
   }

src/main/java/com/google/devtools/build/lib/bazel/bzlmod/IndexRegistry.java

@@ -131,6 +131,10 @@ public String getUrl() {
     return uri.toString();
   }
 
+  private boolean isLocal() {
+    return uri.getScheme().equals("file");
+  }
+
   private String constructUrl(String base, String... segments) {
     StringBuilder url = new StringBuilder(base);
     for (String segment : segments) {
@@ -380,7 +384,7 @@ public RepoSpec getRepoSpec(
             parseJson(jsonString.get(), jsonUrl, GitRepoSourceJson.class);
         var moduleFileUrl = constructModuleFileUrl(key);
         var moduleFileChecksum = moduleFileHashes.get(moduleFileUrl).get();
-        return createGitRepoSpec(typedSourceJson, moduleFileUrl, moduleFileChecksum);
+        return createGitRepoSpec(typedSourceJson, moduleFileUrl, moduleFileChecksum, key);
       }
       default ->
           throw new IOException(
@@ -521,34 +525,52 @@ private RepoSpec createArchiveRepoSpec(
                                     "overlay",
                                     entry.getKey())))));
 
-    return new ArchiveRepoSpecBuilder()
-        .setUrls(urls.build())
-        .setIntegrity(sourceJson.integrity)
-        .setStripPrefix(Strings.nullToEmpty(sourceJson.stripPrefix))
-        .setRemotePatches(remotePatches.buildOrThrow())
-        .setOverlay(overlay)
-        .setRemoteModuleFile(
-            new RemoteFile(
-                moduleFileChecksum.toSubresourceIntegrity(), ImmutableList.of(moduleFileUrl)))
-        .setRemotePatchStrip(sourceJson.patchStrip)
-        .setArchiveType(sourceJson.archiveType)
-        .build();
+    var builder =
+        new ArchiveRepoSpecBuilder()
+            .setUrls(urls.build())
+            .setIntegrity(sourceJson.integrity)
+            .setStripPrefix(Strings.nullToEmpty(sourceJson.stripPrefix))
+            .setRemotePatches(remotePatches.buildOrThrow())
+            .setOverlay(overlay)
+            .setRemoteModuleFile(
+                new RemoteFile(
+                    moduleFileChecksum.toSubresourceIntegrity(), ImmutableList.of(moduleFileUrl)))
+            .setRemotePatchStrip(sourceJson.patchStrip)
+            .setArchiveType(sourceJson.archiveType);
+    if (!isLocal()) {
+      builder.setPurlFragments(getPurlFragments(key));
+    }
+    return builder.build();
   }
 
   private RepoSpec createGitRepoSpec(
-      GitRepoSourceJson sourceJson, String moduleFileUrl, Checksum moduleFileChecksum) {
-    return new GitRepoSpecBuilder()
-        .setRemote(sourceJson.remote)
-        .setCommit(sourceJson.commit)
-        .setShallowSince(sourceJson.shallowSince)
-        .setTag(sourceJson.tag)
-        .setInitSubmodules(sourceJson.initSubmodules)
-        .setVerbose(sourceJson.verbose)
-        .setStripPrefix(sourceJson.stripPrefix)
-        .setRemoteModuleFile(
-            new RemoteFile(
-                moduleFileChecksum.toSubresourceIntegrity(), ImmutableList.of(moduleFileUrl)))
-        .build();
+      GitRepoSourceJson sourceJson,
+      String moduleFileUrl,
+      Checksum moduleFileChecksum,
+      ModuleKey key) {
+    var builder =
+        new GitRepoSpecBuilder()
+            .setRemote(sourceJson.remote)
+            .setCommit(sourceJson.commit)
+            .setShallowSince(sourceJson.shallowSince)
+            .setTag(sourceJson.tag)
+            .setInitSubmodules(sourceJson.initSubmodules)
+            .setVerbose(sourceJson.verbose)
+            .setStripPrefix(sourceJson.stripPrefix)
+            .setRemoteModuleFile(
+                new RemoteFile(
+                    moduleFileChecksum.toSubresourceIntegrity(), ImmutableList.of(moduleFileUrl)));
+    if (!isLocal()) {
+      builder.setPurlFragments(getPurlFragments(key));
+    }
+    return builder.build();
+  }
+
+  private ImmutableMap<String, String> getPurlFragments(ModuleKey moduleKey) {
+    // TODO: Pass in the registry URI once supported by package_metadata's purl function.
+    return ImmutableMap.of(
+        "name", moduleKey.name(),
+        "version", moduleKey.version().toString());
   }
 
   @Override

src/main/java/com/google/devtools/build/lib/bazel/bzlmod/ModuleKey.java

@@ -52,7 +52,13 @@ public record ModuleKey(String name, Version version) {
           // the host constraints generated by local_config_platform would reference the "platforms"
           // module repository, resulting in a toolchain resolution mismatch.
           "platforms",
-          RepositoryName.createUnvalidated("platforms"));
+          RepositoryName.createUnvalidated("platforms"),
+          // This is necessary to allow http_archive and git_repository, when used to bring in a
+          // Bazel module, to inject load statements for the package_metadata rule into the repos
+          // they create. If they had to resolve an apparent name, module resolution would end up
+          // in a cycle.
+          "package_metadata",
+          RepositoryName.createUnvalidated("package_metadata"));
 
   public static final ModuleKey ROOT = new ModuleKey("", Version.EMPTY);
 

src/test/java/com/google/devtools/build/lib/bazel/bzlmod/IndexRegistryTest.java

@@ -256,6 +256,7 @@ public void testGetArchiveRepoSpec() throws Exception {
                         sha256("module(name = \"foo\", version = \"1.0\")")
                             .toSubresourceIntegrity(),
                         ImmutableList.of(server.getUrl() + "/modules/foo/1.0/MODULE.bazel")))
+                .setPurlFragments(ImmutableMap.of("name", "foo", "version", "1.0"))
                 .setRemotePatchStrip(0)
                 .build());
     assertThat(
@@ -283,6 +284,7 @@ public void testGetArchiveRepoSpec() throws Exception {
                         sha256("module(name = \"bar\", version = \"2.0\")")
                             .toSubresourceIntegrity(),
                         ImmutableList.of(server.getUrl() + "/modules/bar/2.0/MODULE.bazel")))
+                .setPurlFragments(ImmutableMap.of("name", "bar", "version", "2.0"))
                 .build());
     assertThat(
             registry.getRepoSpec(
@@ -312,6 +314,7 @@ public void testGetArchiveRepoSpec() throws Exception {
                         ImmutableList.of(server.getUrl() + "/modules/baz/3.0/MODULE.bazel")))
                 .setRemotePatches(ImmutableMap.of())
                 .setRemotePatchStrip(0)
+                .setPurlFragments(ImmutableMap.of("name", "baz", "version", "3.0"))
                 .build());
   }
 
@@ -365,6 +368,7 @@ public void testGetGitRepoSpec() throws Exception {
                         sha256("module(name = \"foo\", version = \"1.0\")")
                             .toSubresourceIntegrity(),
                         ImmutableList.of(server.getUrl() + "/modules/foo/1.0/MODULE.bazel")))
+                .setPurlFragments(ImmutableMap.of("name", "foo", "version", "1.0"))
                 .build());
   }
 
@@ -435,6 +439,7 @@ public void testGetRepoInvalidRegistryJsonSpec() throws Exception {
                             .toSubresourceIntegrity(),
                         ImmutableList.of(server.getUrl() + "/modules/foo/1.0/MODULE.bazel")))
                 .setRemotePatchStrip(0)
+                .setPurlFragments(ImmutableMap.of("name", "foo", "version", "1.0"))
                 .build());
   }
 
@@ -556,6 +561,7 @@ public void testArchiveWithExplicitType() throws Exception {
                             .toSubresourceIntegrity(),
                         ImmutableList.of(
                             server.getUrl() + "/modules/archive_type/1.0/MODULE.bazel")))
+                .setPurlFragments(ImmutableMap.of("name", "archive_type", "version", "1.0"))
                 .build());
   }
 

src/test/py/bazel/bzlmod/bazel_lockfile_test.py

@@ -44,16 +44,16 @@ def setUp(self):
         [
             # In ipv6 only network, this has to be enabled.
             # 'startup --host_jvm_args=-Djava.net.preferIPv6Addresses=true',
-            'build --experimental_isolated_extension_usages',
-            'build --registry=' + self.main_registry.getURL(),
+            'common --experimental_isolated_extension_usages',
+            'common --registry=' + self.main_registry.getURL(),
             # We need to have BCR here to make sure built-in modules like
             # bazel_tools can work.
-            'build --registry=https://bcr.bazel.build',
-            'build --verbose_failures',
+            'common --registry=https://bcr.bazel.build',
+            'common --verbose_failures',
             # Set an explicit Java language version
-            'build --java_language_version=8',
-            'build --tool_java_language_version=8',
-            'build --lockfile_mode=update',
+            'common --java_language_version=8',
+            'common --tool_java_language_version=8',
+            'common --lockfile_mode=update',
         ],
     )
     # TODO(pcloudy): investigate why this is needed, MODULE.bazel.lock is not

src/test/py/bazel/bzlmod/bazel_module_test.py

@@ -14,6 +14,7 @@
 # limitations under the License.
 # pylint: disable=g-long-ternary
 
+import json
 import os
 import pathlib
 import shutil
@@ -25,6 +26,7 @@
 from src.test.py.bazel import test_base
 from src.test.py.bazel.bzlmod.test_utils import BazelRegistry
 from src.test.py.bazel.bzlmod.test_utils import integrity
+from src.test.py.bazel.bzlmod.test_utils import queryTargetAttr
 from src.test.py.bazel.bzlmod.test_utils import read
 from src.test.py.bazel.bzlmod.test_utils import scratchFile
 
@@ -51,18 +53,18 @@ def setUp(self):
         [
             # In ipv6 only network, this has to be enabled.
             # 'startup --host_jvm_args=-Djava.net.preferIPv6Addresses=true',
-            'build --incompatible_disable_native_repo_rules',
-            'build --registry=' + self.main_registry.getURL(),
+            'common --incompatible_disable_native_repo_rules',
+            'common --registry=' + self.main_registry.getURL(),
             # We need to have BCR here to make sure built-in modules like
             # bazel_tools can work.
-            'build --registry=https://bcr.bazel.build',
-            'build --verbose_failures',
+            'common --registry=https://bcr.bazel.build',
+            'common --verbose_failures',
             # Set an explicit Java language version
-            'build --java_language_version=8',
-            'build --tool_java_language_version=8',
-            'build --lockfile_mode=update',
+            'common --java_language_version=8',
+            'common --tool_java_language_version=8',
+            'common --lockfile_mode=update',
             (  # fmt: skip pylint: disable=line-too-long
-                'build'
+                'common'
                 ' --extra_toolchains=@bazel_tools//tools/python:autodetecting_toolchain'
             ),
         ],
@@ -141,6 +143,15 @@ def testSimple(self):
     _, stdout, _ = self.RunBazel(['run', '//:main'])
     self.assertIn('main function => aaa@1.0', stdout)
 
+    # Verify the default package metadata.
+    package_metadata = queryTargetAttr(
+        self, '@aaa//:lib_aaa', 'package_metadata'
+    )['stringListValue']
+    self.assertEqual(len(package_metadata), 1)
+    package_metadata_target = package_metadata[0]
+    purl = queryTargetAttr(self, package_metadata_target, 'purl')['stringValue']
+    self.assertEqual(purl, 'pkg:bazel/aaa@1.0')
+
   def testSimpleTransitive(self):
     self.ScratchFile('MODULE.bazel', [
         'bazel_dep(name = "bbb", version = "1.0")',