From 23e3b2a7d6eed2fc342264748c25ef84cb3aeecc Mon Sep 17 00:00:00 2001
From: Pat Hickey <p.hickey@f5.com>
Date: Thu, 21 Aug 2025 10:58:10 -0700
Subject: [PATCH] feat: add processed-by annotation using wasm-metadata crate

---
 Cargo.lock           | 45 ++++++++++++++++++++++++++++++++++++++++++++
 Cargo.toml           |  1 +
 transform/Cargo.toml |  1 +
 transform/src/lib.rs |  8 ++++++++
 4 files changed, 55 insertions(+)

diff --git a/Cargo.lock b/Cargo.lock
index 873d928..fd09463 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -111,6 +111,18 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "auditable-serde"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c7bf8143dfc3c0258df908843e169b5cc5fcf76c7718bd66135ef4a9cd558c5"
+dependencies = [
+ "semver",
+ "serde",
+ "serde_json",
+ "topological-sort",
+]
+
 [[package]]
 name = "autocfg"
 version = "1.4.0"
@@ -387,6 +399,7 @@ dependencies = [
  "async-trait",
  "futures",
  "wasm-encoder 0.235.0",
+ "wasm-metadata",
  "wasmparser 0.235.0",
 ]
 
@@ -720,6 +733,16 @@ dependencies = [
  "windows-sys 0.59.0",
 ]
 
+[[package]]
+name = "flate2"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a3d7db9596fecd151c5f638c0ee5d5bd487b6e0ea232e5dc96d5250f6f94b1d"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+]
+
 [[package]]
 name = "foldhash"
 version = "0.1.4"
@@ -1687,6 +1710,15 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "spdx"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3e17e880bafaeb362a7b751ec46bdc5b61445a188f80e0606e68167cd540fa3"
+dependencies = [
+ "smallvec",
+]
+
 [[package]]
 name = "stable_deref_trait"
 version = "1.2.0"
@@ -1888,6 +1920,12 @@ version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
 
+[[package]]
+name = "topological-sort"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea68304e134ecd095ac6c3574494fc62b909f416c4fca77e440530221e549d3d"
+
 [[package]]
 name = "tracing"
 version = "0.1.41"
@@ -2093,7 +2131,14 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b055604ba04189d54b8c0ab2c2fc98848f208e103882d5c0b984f045d5ea4d20"
 dependencies = [
  "anyhow",
+ "auditable-serde",
+ "flate2",
  "indexmap",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "spdx",
+ "url",
  "wasm-encoder 0.235.0",
  "wasmparser 0.235.0",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index f9f4adf..c39c789 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -37,3 +37,4 @@ wasmtime-wasi = "34.0.1"
 wasmtime-wasi-http = "34.0.1"
 wat = "1.235.0"
 wit-bindgen = "0.43.0"
+wasm-metadata = "0.235.0"
diff --git a/transform/Cargo.toml b/transform/Cargo.toml
index ba4aca9..96f88df 100644
--- a/transform/Cargo.toml
+++ b/transform/Cargo.toml
@@ -11,3 +11,4 @@ async-trait.workspace = true
 futures.workspace = true
 wasm-encoder.workspace = true
 wasmparser.workspace = true
+wasm-metadata.workspace = true
diff --git a/transform/src/lib.rs b/transform/src/lib.rs
index df30313..7f70551 100644
--- a/transform/src/lib.rs
+++ b/transform/src/lib.rs
@@ -849,6 +849,14 @@ fn apply(
 
     let initialized_component = initialized_component.finish();
 
+    let mut add = wasm_metadata::AddMetadata::default();
+    add.processed_by = vec![(
+        "component-init-transform".to_owned(),
+        env!("CARGO_PKG_VERSION").to_owned(),
+    )];
+
+    let initialized_component = add.to_wasm(&initialized_component)?;
+
     Validator::new().validate_all(&initialized_component)?;
 
     Ok(initialized_component)