Add org.opencontainers labels to Docker images

hooks/build

@@ -4,10 +4,41 @@ echo ">>> Building images..."
 
 source ./hooks/arches.sh
 
+if [[ -z "${SOURCE_COMMIT}" ]]; then
+    # This var is typically predefined by Docker Hub, but it won't be
+    # when testing locally.
+    SOURCE_COMMIT="$(git rev-parse HEAD)"
+fi
+
+# Construct a version string in the style of `build.rs`.
+GIT_EXACT_TAG="$(git describe --tags --abbrev=0 --exact-match 2>/dev/null)"
+if [[ -n "${GIT_EXACT_TAG}" ]]; then
+    SOURCE_VERSION="${GIT_EXACT_TAG}"
+else
+    GIT_LAST_TAG="$(git describe --tags --abbrev=0)"
+    SOURCE_VERSION="${GIT_LAST_TAG}-${SOURCE_COMMIT:0:8}"
+fi
+
+LABELS=(
+    # https://github.com/opencontainers/image-spec/blob/master/annotations.md
+    org.opencontainers.image.created="$(date --utc --iso-8601=seconds)"
+    org.opencontainers.image.documentation="https://github.com/dani-garcia/bitwarden_rs/wiki"
+    org.opencontainers.image.licenses="GPL-3.0-only"
+    org.opencontainers.image.revision="${SOURCE_COMMIT}"
+    org.opencontainers.image.source="${SOURCE_REPOSITORY_URL}"
+    org.opencontainers.image.url="https://hub.docker.com/r/${DOCKER_REPO#*/}"
+    org.opencontainers.image.version="${SOURCE_VERSION}"
+)
+LABEL_ARGS=()
+for label in "${LABELS[@]}"; do
+    LABEL_ARGS+=(--label "${label}")
+done
+
 set -ex
 
 for arch in "${arches[@]}"; do
     docker build \
+           "${LABEL_ARGS[@]}" \
            -t "${DOCKER_REPO}:${DOCKER_TAG}-${arch}" \
            -f docker/${arch}/Dockerfile${distro_suffix} \
            .

hooks/pre_build

@@ -2,13 +2,15 @@
 
 set -ex
 
-# Print some environment info in case it's useful for troubleshooting.
+# If requested, print some environment info for troubleshooting.
+if [[ -n "${DOCKER_HUB_DEBUG}" ]]; then
     id
     pwd
     df -h
     env
     docker info
     docker version
+fi
 
 # Install build dependencies.
 deps=(
@@ -16,3 +18,11 @@ deps=(
 )
 apt-get update
 apt-get install -y "${deps[@]}"
+
+# Docker Hub uses a shallow clone and doesn't fetch tags, which breaks some
+# Git operations that we perform later, so fetch the complete history and
+# tags first. Note that if the build is cached, the clone may have been
+# unshallowed already; if so, unshallowing will fail, so skip it.
+if [[ -f .git/shallow ]]; then
+    git fetch --unshallow --tags
+fi