Worker/koji-finalize: include composer and deps version in manifest MD

Include the osbuild-composer and its dependencies versions in the extra
metadata associated with the Manifest output when importing it to Koji.

This will make it possible to pin-point the exact version combination
which was used to generate the osbuild manifest used to built the image
imported to Koji.

Signed-off-by: Tomáš Hozza <thozza@redhat.com>

cmd/osbuild-worker/jobimpl-koji-finalize.go

@@ -225,6 +225,30 @@ func (impl *KojiFinalizeJobImpl) Run(job worker.Job) error {
 		// TODO: Condition below is present for backward compatibility with old workers which don't upload the manifest.
 		// TODO: Remove the condition it in the future.
 		if kojiTargetOptions.OSBuildManifest != nil {
+			manifestExtraInfo := koji.ManifestExtraInfo{
+				Arch: buildResult.Arch,
+			}
+
+			if kojiTargetOptions.OSBuildManifestInfo != nil {
+				manifestInfo := &koji.ManifestInfo{
+					OSBuildComposerVersion: kojiTargetOptions.OSBuildManifestInfo.OSBuildComposerVersion,
+				}
+				for _, composerDep := range kojiTargetOptions.OSBuildManifestInfo.OSBuildComposerDeps {
+					dep := &koji.OSBuildComposerDepModule{
+						Path:    composerDep.Path,
+						Version: composerDep.Version,
+					}
+					if composerDep.Replace != nil {
+						dep.Replace = &koji.OSBuildComposerDepModule{
+							Path:    composerDep.Replace.Path,
+							Version: composerDep.Replace.Version,
+						}
+					}
+					manifestInfo.OSBuildComposerDeps = append(manifestInfo.OSBuildComposerDeps, dep)
+				}
+				manifestExtraInfo.Info = manifestInfo
+			}
+
 			outputs = append(outputs, koji.BuildOutput{
 				BuildRootID:  uint64(i),
 				Filename:     kojiTargetOptions.OSBuildManifest.Filename,
@@ -234,9 +258,7 @@ func (impl *KojiFinalizeJobImpl) Run(job worker.Job) error {
 				Checksum:     kojiTargetOptions.OSBuildManifest.Checksum,
 				Type:         koji.BuildOutputTypeManifest,
 				Extra: &koji.BuildOutputExtra{
-					ImageOutput: koji.ManifestExtraInfo{
+					ImageOutput: manifestExtraInfo,
-						Arch: buildResult.Arch,
-					},
 				},
 			})
 		}

internal/upload/koji/koji.go

@@ -130,12 +130,25 @@ type ImageExtraInfo struct {
 
 func (ImageExtraInfo) isImageOutputTypeMD() {}
 
+type OSBuildComposerDepModule struct {
+	Path    string                    `json:"path"`
+	Version string                    `json:"version"`
+	Replace *OSBuildComposerDepModule `json:"replace,omitempty"`
+}
+
+// ManifestInfo holds information about the environment in which
+// the manifest was produced and which could affect its content.
+type ManifestInfo struct {
+	OSBuildComposerVersion string `json:"osbuild_composer_version"`
+	// List of relevant modules used by osbuild-composer which
+	// could affect the manifest content.
+	OSBuildComposerDeps []*OSBuildComposerDepModule `json:"osbuild_composer_deps,omitempty"`
+}
+
 // ManifestExtraInfo holds extra metadata about the osbuild manifest.
 type ManifestExtraInfo struct {
-	// TODO: include osbuild-composer version which produced the manifest?
+	Arch string        `json:"arch"`
-	// TODO: include the vendored 'images' version?
+	Info *ManifestInfo `json:"info,omitempty"`
-
-	Arch string `json:"arch"`
 }
 
 func (ManifestExtraInfo) isImageOutputTypeMD() {}