feat: make image generation deterministic by default

[kruskall]

This PR makes image generation deterministic by default:

• timestamps are zeroed out for reproducibility (see Zero out timestamps for reproducibility #48)
• apk is writing a tar archive to lib/apk/db/scripts.tar, to support reproducible builds the timestamps inside the archive needs to be deterministic/zeroed.

Note: according to the spec of SOURCE_DATE_EPOCH (https://reproducible-builds.org/specs/source-date-epoch/):

Build processes MUST use this variable for embedded timestamps in place of the "current" date and time.

Since time.Now has been replaced with the zero value (January 1, year 1, 00:00:00.000000000 UTC) there's no need for SOURCE_DATE_EPOCH.

Note: reproducible image generation has been tested with https://diffoscope.org/

Closes #48

cc @imjasonh

[kaniini]

Since time.Now has been replaced with the zero value (January 1, year 1, 00:00:00.000000000 UTC) there's no need for SOURCE_DATE_EPOCH.

Some users do not like seeing timestamps of 1970 in things like ls output. It would be nice to support SOURCE_DATE_EPOCH, and also have an option to set SOURCE_DATE_EPOCH to time.Now().

[kruskall]

Some users do not like seeing timestamps of 1970 in things like ls output. It would be nice to support SOURCE_DATE_EPOCH, and also have an option to set SOURCE_DATE_EPOCH to time.Now().

I'm ok with supporting SOURCE_DATE_EPOCH but an environment variable is a bit opaque in term of UI, I think there should be a easier/simpler way for the user to make the image reproducible. Maybe an additional flag ? WDYT ?

[kaniini]

I'm ok with supporting SOURCE_DATE_EPOCH but an environment variable is a bit opaque in term of UI, I think there should be a easier/simpler way for the user to make the image reproducible. Maybe an additional flag ? WDYT ?

Yes, a global option --build-date would be great, with --build-date=now being equivalent to time.Now().

[kruskall]

rebased on the main branch and fixed the merge conflicts 🎉

[kaniini]

@imjasonh @puerco what do you think?

[imjasonh]

LGTM!

[imjasonh]

Ugh, I'm a dummy, it's supposed to be seconds since epoch, not RFC3339: https://github.com/google/ko/blob/3fc720f912ac5192cff518a31fa6621e4a0dba51/pkg/commands/config.go#L129

Sorry for the confusion. I won't be able to send a PR until maybe tonight, but I'll happily review anything.

[imjasonh]

Extra dumb! That's exactly what you have. Ignore me, it's the Fridays.