Skip to content

Add flag to make manifest and tar reproducible#2039

Open
afbjorklund wants to merge 1 commit intooras-project:mainfrom
afbjorklund:reproducible
Open

Add flag to make manifest and tar reproducible#2039
afbjorklund wants to merge 1 commit intooras-project:mainfrom
afbjorklund:reproducible

Conversation

@afbjorklund
Copy link
Copy Markdown

This will set the timestamps to the zero time.Time timestamp, to avoid it being set to the current/modification timestamp.

For the manifest this translates to 0001-01-01, but for the tarball it translates to 1970-01-01 (since it uses seconds).

What this PR does / why we need it:

Adds --reproducible flag, to push and attach.
This will make their resulting digests deterministic.

Which issue(s) this PR fixes:

Fixes #1464

Please check the following list:

  • Does the affected code have corresponding tests, e.g. unit test, E2E test?
  • Does this change require a documentation update?
  • Does this introduce breaking changes that would require an announcement or bumping the major version?
  • Do all new files have an appropriate license header?

This will set the timestamps to the zero time.Time timestamp,
to avoid it being set to the current/modification timestamp.

For the manifest this translates to 0001-01-01, but for the
tarball it translates to 1970-01-01 (since it uses seconds).

Signed-off-by: Anders F Björklund <anders.f.bjorklund@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

make oras push and oras attach deterministic

1 participant