This PR implements Spin's Component Dependencies feature

Signed-off-by: Brian H <brian.hardock@fermyon.com>

crates/app/Cargo.toml

@@ -12,5 +12,4 @@ serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 spin-core = { path = "../core" }
 spin-locked-app = { path = "../locked-app" }
-spin-serde = { path = "../serde" }
 thiserror = "1.0"

crates/app/src/lib.rs

@@ -41,12 +41,13 @@ pub trait Loader {
     /// representation of a [`LockedApp`], which will be loaded.
     async fn load_app(&self, uri: &str) -> anyhow::Result<LockedApp>;
 
-    /// Called with a [`LockedComponentSource`] pointing to a Wasm component
-    /// binary, which will be loaded.
+    /// Called with a [`LockedComponent`]; the Wasm component binary specified
+    /// by source will be componentized and composed with each of its
+    /// dependencies.
     async fn load_component(
         &self,
         engine: &wasmtime::Engine,
-        source: &LockedComponentSource,
+        component: &LockedComponent,
     ) -> anyhow::Result<spin_core::Component>;
 
     /// Called with a [`LockedComponentSource`] pointing to a Wasm module
@@ -282,6 +283,7 @@ impl App<'static, InertLoader> {
 pub struct AppComponent<'a, L = AppLoader> {
     /// The app this component belongs to.
     pub app: &'a App<'a, L>,
+    /// The locked component.
     locked: &'a LockedComponent,
 }
 
@@ -337,7 +339,7 @@ impl<'a> AppComponent<'a> {
         self.app
             .loader
             .inner
-            .load_component(engine.as_ref(), &self.locked.source)
+            .load_component(engine.as_ref(), self.locked)
             .await
             .map_err(Error::LoaderError)
     }

crates/common/Cargo.toml

@@ -6,8 +6,8 @@ edition = { workspace = true }
 
 [dependencies]
 anyhow = "1.0"
-dirs = "4.0"
+dirs = "5.0.1"
 sha2 = "0.10"
 tempfile = "3.5"
 tokio = { version = "1", features = ["rt", "time"] }
-url = "2"
+url = "2"

crates/compose/Cargo.toml

@@ -0,0 +1,25 @@
+[package]
+name = "spin-compose"
+version.workspace = true
+authors.workspace = true
+edition.workspace = true
+license.workspace = true
+homepage.workspace = true
+repository.workspace = true
+rust-version.workspace = true
+
+[dependencies]
+anyhow = { workspace = true }
+async-trait = "0.1"
+
+indexmap = "2.2.6"
+spin-app = { path = "../app" }
+spin-serde = { path = "../serde" }
+spin-componentize = { workspace = true }
+semver = "1"
+thiserror = "1"
+tokio = { version = "1.23", features = ["fs"] }
+wac-graph = "0.5.0"
+
+[lints]
+workspace = true

crates/compose/deny-all/Cargo.toml

@@ -0,0 +1,34 @@
+[package]
+name = "deny-all"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+wit-bindgen-rt = { version = "0.28.0", features = ["bitflags"] }
+
+[lib]
+crate-type = ["cdylib"]
+
+[profile.release]
+codegen-units = 1
+opt-level = "s"
+debug = false
+strip = true
+lto = true
+
+[package.metadata.component]
+package = "fermyon:spin-virt"
+
+[package.metadata.component.target]
+world = "deny-all"
+
+[package.metadata.component.target.dependencies]
+"fermyon:spin" = { path = "wit/deps/fermyon/spin.wasm" }
+"wasi:filesystem" = { path = "wit/deps/wasi/filesystem.wasm" }
+"wasi:sockets" = { path = "wit/deps/wasi/sockets.wasm" }
+"wasi:clocks" = { path = "wit/deps/wasi/clocks.wasm" }
+"wasi:http" = { path = "wit/deps/wasi/http.wasm" }
+"wasi:cli" = { path = "wit/deps/wasi/cli.wasm" }
+"wasi:io" = { path = "wit/deps/wasi/io.wasm" }
+
+[workspace]

crates/compose/deny-all/README.md

@@ -0,0 +1,6 @@
+This directory contains the `deny-all` adapter used to enforce configuration isolation in dependencies when using the component dependencies feature of Spin.
+
+To build:
+```
+cargo component build --release
+```