feat: allow per-extension license metadata

This change introduces a `licenses` field to the metadata schema, allowing each
extension to define its own SPDX license identifier. The `docker-bake.hcl` has
been updated to use this metadata for OCI labels and annotations instead of a
hardcoded "Apache-2.0" string.

This enables proper legal transparency for extensions with different, yet
compatible, licensing requirements, such as PostGIS (`GPL-2.0-only`).

Changes:

- Added `licenses` field to metadata.hcl template
- Updated docker-bake.hcl to reference `${metadata.licenses}`
- Updated `metadata.hcl` for the existing extensions

Closes #110

Signed-off-by: Gabriele Bartolini <gabriele.bartolini@enterprisedb.com>

Author: gbartolini

docker-bake.hcl

@@ -74,7 +74,7 @@ target "default" {
     "index,manifest:org.opencontainers.image.description=A ${metadata.name} ${getExtensionVersion(distro, pgVersion)} container image for PostgreSQL ${pgVersion} on ${distro}",
     "index,manifest:org.opencontainers.image.documentation=${url}",
     "index,manifest:org.opencontainers.image.authors=${authors}",
-    "index,manifest:org.opencontainers.image.licenses=Apache-2.0",
+    "index,manifest:org.opencontainers.image.licenses=${metadata.licenses}",
     "index,manifest:org.opencontainers.image.base.name=scratch",
     "index,manifest:io.cloudnativepg.image.base.name=${getBaseImage(distro, pgVersion)}",
     "index,manifest:io.cloudnativepg.image.base.pgmajor=${pgVersion}",
@@ -91,7 +91,7 @@ target "default" {
     "org.opencontainers.image.description" = "A ${metadata.name} ${getExtensionVersion(distro, pgVersion)} container image for PostgreSQL ${pgVersion} on ${distro}",
     "org.opencontainers.image.documentation" = "${url}",
     "org.opencontainers.image.authors" = "${authors}",
-    "org.opencontainers.image.licenses" = "Apache-2.0",
+    "org.opencontainers.image.licenses" = "${metadata.licenses}",
     "org.opencontainers.image.base.name" = "scratch",
     "io.cloudnativepg.image.base.name" = "${getBaseImage(distro, pgVersion)}",
     "io.cloudnativepg.image.base.pgmajor" = "${pgVersion}",

pgaudit/metadata.hcl

@@ -2,6 +2,7 @@ metadata = {
   name                     = "pgaudit"
   sql_name                 = "pgaudit"
   image_name               = "pgaudit"
+  licenses                 = "PostgreSQL"
   shared_preload_libraries = ["pgaudit"]
   extension_control_path   = []
   dynamic_library_path     = []

pgvector/metadata.hcl

@@ -2,6 +2,7 @@ metadata = {
   name                     = "pgvector"
   sql_name                 = "vector"
   image_name               = "pgvector"
+  licenses                 = "PostgreSQL"
   shared_preload_libraries = []
   extension_control_path   = []
   dynamic_library_path     = []

postgis/metadata.hcl

@@ -2,6 +2,7 @@ metadata = {
   name                     = "postgis"
   sql_name                 = "postgis"
   image_name               = "postgis-extension"
+  licenses                 = "GPL-2.0-or-later AND Apache-2.0 AND MIT AND LGPL-2.1-only AND LGPL-3.0-or-later"
   shared_preload_libraries = []
   extension_control_path   = []
   dynamic_library_path     = []

templates/metadata.hcl.tmpl

@@ -9,6 +9,12 @@ metadata = {
   # it identifies the image (e.g. ghcr.io/cloudnative-pg/<image_name>)
   image_name               = "{{ .Name }}"
 
+  # TODO: Remove this comment block after customizing the file.
+  # `licenses`: The SPDX license identifier for the extension software.
+  # Examples: "Apache-2.0", "PostgreSQL", "GPL-2.0-only".
+  # See: https://spdx.org/licenses/
+  licenses                 = "Apache-2.0"
+
   # TODO: Remove this comment block after customizing the file.
   # `shared_preload_libraries`: list libraries to be added to
   # `shared_preload_libraries` in Postgres. Usually empty.