Commits on Jun 11, 2024

1. Support reproducible builds (except packages) …

   See docker-library/official-images issue 16044
   
   - `SOURCE_DATE_EPOCH` is added.
     The value is consumed by the build scripts to make the binary reproducible.
   
   - For Debian, `/var/log/*` is removed as they contain timestamps
   
   - For Debian, `/var/cache/ldconfig/aux-cache` is removed as they contain inode numbers, etc.
   
   - For Alpine, virtual package versions are pinned to "0" to eliminate
     the timestamp-based version numbers that appear in `/etc/apk/world` and `/lib/apk/db/installed`
   
   > [!NOTE]
   > The following topics are NOT covered by this commit:
   >
   > - To reproduce file timestamps in layers, BuildKit has to be executed with
   >   `--output type=<TYPE>,rewrite-timestamp=true`.
   >   Needs BuildKit v0.13 or later.
   >
   > - To reproduce the base image by the hash, reproducers may:
   >   - modify the `FROM` instruction in Dockerfile manually
   >   - or, use the `CONVERT` action of source policies to replace the base image.
   >     <https://github.com/moby/buildkit/blob/v0.13.2/docs/build-repro.md>
   >
   > - To reproduce packages, see the `RUN` instruction hook proposed in
   >   moby/buildkit issue 4576
   
   Also, Alpine-based images still have the following diff:
   ```diff
   diff -ur /tmp/foo/diff/input-0/layers-3/lib/apk/db/installed /tmp/foo/diff/input-1/layers-3/lib/apk/db/installed
   --- /tmp/foo/diff/input-0/layers-3/lib/apk/db/installed 2024-04-26 07:07:33.000000000 +0900
   +++ /tmp/foo/diff/input-1/layers-3/lib/apk/db/installed 2024-04-26 07:07:33.000000000 +0900
   @@ -1,4 +1,4 @@
   -C:Q1z4Lv7mwS00FpNJwDUHdH70eM2ic=
   +C:Q1gHSJHNX/rtq0yNsVTKaNb96s8Mk=
    P:.ruby-rundeps
    V:0
    A:noarch
   ```
   
   Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>

   

   AkihiroSuda committed Jun 11, 2024
   Configuration menu

   • View commit details
   • Copy full SHA for 9656701
   • Browse repository at this point

   Copy the full SHA

   9656701 View commit details

   Browse the repository at this point in the history