Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support reproducible builds (except packages) #250

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

AkihiroSuda
Copy link

@AkihiroSuda AkihiroSuda commented Jan 22, 2024

Background:

Alternative to:


  • SOURCE_DATE_EPOCH is added. The value is consumed by the build scripts to make the httpd binary reproducible.

  • GNU implementation of wget is executed with --no-hsts to disable creating /root/.wget-hsts

  • For Debian, /var/log/* is removed as they contain timestamps

  • For Debian, /var/cache/ldconfig/aux-cache is removed as they contain inode numbers, etc.

  • For Alpine, virtual package versions are pinned to "0" to eliminate the timestamp-based version numbers that appear in /etc/apk/world and /lib/apk/db/installed

Note

The following topics are NOT covered by this commit:

@AkihiroSuda
Copy link
Author

@tianon @yosifkit PTAL 🙏

@AkihiroSuda
Copy link
Author

@tianon @yosifkit

I think this is good to merge.
Unlike #248 , this does not suffer from the slow apt-get.

MikArmMuscle

This comment was marked as spam.

See docker-library/official-images issue 16044

- `SOURCE_DATE_EPOCH` is added.
  The value is consumed by the build scripts to make the `httpd` binary reproducible.

- GNU implementation of `wget` is executed with `--no-hsts` to disable creating `/root/.wget-hsts`

- For Debian, `/var/log/*` is removed as they contain timestamps

- For Debian, `/var/cache/ldconfig/aux-cache` is removed as they contain inode numbers, etc.

- For Alpine, virtual package versions are pinned to "0" to eliminate
  the timestamp-based version numbers that appear in `/etc/apk/world` and `/lib/apk/db/installed`

> [!NOTE]
> The following topics are NOT covered by this commit:
>
> - To reproduce file timestamps in layers, BuildKit has to be executed with
>   `--output type=<TYPE>,rewrite-timestamp=true`.
>   Needs BuildKit v0.13 or later.
>
> - To reproduce the base image by the hash, reproducers may:
>   - modify the `FROM` instruction in Dockerfile manually
>   - or, use the `CONVERT` action of source policies to replace the base image.
>     <https://github.com/moby/buildkit/blob/v0.13.2/docs/build-repro.md>
>
> - To reproduce packages, see the `RUN` instruction hook proposed in
>   moby/buildkit PR 4576

Signed-off-by: Akihiro Suda <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants