Implement RFC0043: Expanding the Criteria for Reproducible Builds

[ryanmoran]

RFC

Summary

Given the same set of inputs and without leveraging caching, Paketo buildpacks should reproducibly build images.

Many of the buildpacks contain behavior that results in non-reproducible images due to how they treat layer metadata. Specifically, they include a built_at metadata field that includes a timestamp for the instant that this layer was built.

Non-Conforming Buildpacks

Go

• Confirm to RFC RFC0043: Reproducible builds dep#282
• Confirm to RFC RFC0043: Reproducible builds go-build#291
• Confirm to RFC RFC0043: Reproducible builds go-dist#384

Node.js

• Conform to RFC0043: Reproducible Builds node-engine#451
• Conform to RFC0043: Reproducible Builds node-module-bom#67
• Conform to RFC0043: Reproducible Builds npm-install#338
• Conform to RFC0043: Reproducible Builds yarn#212
• Conform to RFC0043: Reproducible Builds yarn-install#322

Python

• Confirm to RFC RFC0043: Reproducible builds conda-env-update#114
• Confirm to RFC RFC0043: Reproducible builds cpython#321
• Confirm to RFC RFC0043: Reproducible builds miniconda#199
• Confirm to RFC RFC0043: Reproducible builds pip#240
• Confirm to RFC RFC0043: Reproducible builds pip-install#113
• Confirm to RFC RFC0043: Reproducible builds pipenv#196
• Confirm to RFC RFC0043: Reproducible builds pipenv-install#110
• Confirm to RFC RFC0043: Reproducible builds poetry#26
• Confirm to RFC RFC0043: Reproducible builds poetry-install#19

.NET Core

• Conform to RFC RFC0043: Reproducible builds dotnet-core-aspnet#313
• Conform to RFC RFC0043: Reproducible builds dotnet-core-runtime#313
• Conform to RFC RFC0043: Reproducible builds dotnet-core-sdk#332
• Conform to RFC RFC0043: Reproducible builds icu#248

Web Servers

• Conform to RFC0043: Reproducible Builds httpd#305
• Conform to RFC0043: Reproducible Builds nginx#360

Ruby

• Conform to RFC RFC0043: Reproducible builds bundle-install#292
• Conform to RFC RFC0043: Reproducible builds bundler#329
• Conform to RFC RFC0043: Reproducible builds mri#346
• Conform to RFC RFC0043: Reproducible builds rails-assets#173

PHP

• Conform to RFC RFC0043: Reproducible builds  php-dist#358
• Conform to RFC RFC0043: Reproducible builds php-fpm#22
• Conform to RFC RFC0043: Reproducible builds php-httpd#7

Utilities

• Conform to RFC0043: Reproducible Builds tini#189

[sophiewigmore]

@ryanmoran should PHP Nginx be added here?

[robdimsdale]

@ryanmoran should PHP Nginx be added here?

My understanding is this is the list of outstanding (and existing), non-conformant buildpacks. php-nginx doesn't yet have code so it's not yet non-conformant :)

It should obey the RFC once it is created!

[robdimsdale]

@paketo-buildpacks/ruby-maintainers please could you assign all the ruby issues to me? I'm not a ruby contributor so I can't assign them to myself

[robdimsdale]

also @paketo-buildpacks/php-maintainers could you assign the php issues to me too? Again, I'm not a php contributor so I can't assign them to myself.

[robdimsdale]

@ryanmoran is there any prior art for the concept of obtaining and checking the SHA of a layer? I don't see any buildpacks doing that currently.

Relatedly, do you have opinions on the value of validating layer reuse? Should we keep the existing tests or remove them entirely?

[ryanmoran]

@ryanmoran is there any prior art for the concept of obtaining and checking the SHA of a layer? I don't see any buildpacks doing that currently.

I don't know of any offhand, but occam is already providing the layer SHAs through this API: https://github.com/paketo-buildpacks/occam/blob/c0f313627bfd6cb9bb52394fd68ce1c13a1bc438/image.go#L20.

Relatedly, do you have opinions on the value of validating layer reuse? Should we keep the existing tests or remove them entirely?

I think keeping the tests is important. They've caught bugs.

[robdimsdale]

For anyone else implementing this RFC - this is an example for the CPython buildpack: paketo-buildpacks/cpython#322.