Reproducible Tarballs #2199
Labels
tech-debt 💳
Debt that the team has charged and needs to repay
Milestone
Comments
5 tasks
Racer159
added a commit
that referenced
this issue
Jan 3, 2024
## Description `archiver@v3` does not expose the functionality needed to create tarballs with file headers containing only deterministic information. As such, back to back package `create`s against the same data will result in differences in SHAs of `components/*.tar` and `sboms.tar`. To remedy this, tarballing up these directories manually is the only current path forward in order to guarantee reproducibility. `archiver@v4` contains such functionality, but is still in `alpha`. ## Related Issue Fixes #2199 ## Type of change - [ ] Bug fix (non-breaking change which fixes an issue) - [x] New feature (non-breaking change which adds functionality) - [ ] Other (security config, docs update, etc) ## Checklist before merging - [ ] Test, docs, adr added or updated as needed - [x] [Contributor Guide Steps](https://github.com/defenseunicorns/zarf/blob/main/CONTRIBUTING.md#developer-workflow) followed --------- Signed-off-by: razzle <harry@razzle.cloud> Co-authored-by: Wayne Starr <Racer159@users.noreply.github.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Describe what should be investigated or refactored
Component tarballs are not reproducible, needs investigation as to which tar headers need to be stripped similar to:
oras-project/oras-go@93c4cc2
https://github.com/moby/moby/blob/v24.0.7/pkg/archive/archive.go#L464
Additional context
Reach out to @Noxsios or @Racer159 for more info
The text was updated successfully, but these errors were encountered: