Sort metadata entries when verifying builds.

Author: fnando

cmd/soroban-cli/src/commands/contract/verify.rs

@@ -728,9 +728,21 @@ fn build_container_command(
     meta: &ExtractedMetadata,
     supports_locked: bool,
 ) -> (Vec<String>, Vec<String>) {
+    // Replay the recorded options in a canonical (sorted) order so the rebuild
+    // command — and the `bldopt`/`--meta` metadata it re-records — doesn't
+    // depend on the order they happened to be recorded in. SEP-58 requires the
+    // metadata entries be sorted, so sorting here rebuilds to that canonical
+    // form even when the original recorded them out of order (a non-conformant
+    // origin). Only `--meta` order affects the WASM's metadata section, but
+    // sorting every option is harmless and keeps the replayed command
+    // deterministic. Mirrors the sort `contract build` applies when writing the
+    // section.
+    let mut bldopts = meta.bldopts.clone();
+    bldopts.sort();
+
     let mut forwarded: Vec<String> = Vec::new();
     let mut env: Vec<String> = Vec::new();
-    for o in &meta.bldopts {
+    for o in &bldopts {
         // Every recorded bldopt is shell-escaped at the source (see
         // `build_forwarded_args` in verifiable.rs) so it's valid shell on its
         // own — e.g. `--meta=source_repo='github:foo'` or `--env=B='a b'`. The
@@ -756,7 +768,7 @@ fn build_container_command(
         source_uri: meta.source_uri.clone(),
         source_sha256: meta.source_sha256.clone(),
     };
-    let metadata = verifiable::build_metadata_args(&meta.bldimg, &ids, &meta.bldopts);
+    let metadata = verifiable::build_metadata_args(&meta.bldimg, &ids, &bldopts);
 
     // When the image supports it, `--locked` is forced — even if the original
     // somehow lacked it (a non-conformant build) — so the verifier insists on a
@@ -1131,6 +1143,42 @@ mod tests {
             .any(|w| w[0] == "--meta" && w[1] == "bldopt=--env=A=1"));
     }
 
+    #[test]
+    fn build_container_command_sorts_replayed_bldopts() {
+        // Recorded in a deliberately unsorted order; the replayed command (and
+        // the `bldopt=` meta it re-records) must come out sorted so the rebuilt
+        // metadata is canonical regardless of the original's recording order.
+        let meta = ExtractedMetadata {
+            bldimg: good_bldimg(),
+            source_uri: Some("https://github.com/foo/bar".to_string()),
+            source_sha256: Some("b".repeat(64)),
+            bldopts: vec![
+                "--meta=zebra=1".to_string(),
+                "--meta=apple=2".to_string(),
+                "--meta=mango=3".to_string(),
+            ],
+        };
+        let (cmd, _env) = build_container_command(&meta, false);
+
+        // The re-recorded `bldopt=` meta values appear in sorted order.
+        let bldopt_metas: Vec<&String> = cmd
+            .windows(2)
+            .filter(|w| w[0] == "--meta" && w[1].starts_with("bldopt="))
+            .map(|w| &w[1])
+            .collect();
+        let mut sorted = bldopt_metas.clone();
+        sorted.sort();
+        assert_eq!(bldopt_metas, sorted, "bldopt metas must be sorted: {cmd:?}");
+        assert_eq!(
+            bldopt_metas,
+            vec![
+                "bldopt=--meta=apple=2",
+                "bldopt=--meta=mango=3",
+                "bldopt=--meta=zebra=1",
+            ]
+        );
+    }
+
     #[test]
     fn build_container_command_unescapes_quoted_meta_bldopt() {
         // Recorded bldopts are shell-escaped at the source, so a `--meta` value