Hacktoberfest 2026: die Issues, die Maintainer für den Oktober markiert haben – offen und einsteigerfreundlich. Hacktoberfest-Issues durchsuchen

Support reproducible builds with SOURCE_DATE_EPOCH

Offen
  • Stimmt etwas nicht?
#307 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
4/5
Geschätzter Aufwand
3-5 Tage
Anfängerfreundlichkeit
52/100
Issue-Typ
Feature
Klarheit
Größtenteils klar
Aktivitätsstatus
Aktiv
Tech-Stack
docker, github-actions
Bereich
build-system, ci-cd

Rechercherichtung

Start with .github/workflows/build.yml, especially the output construction at the referenced v1.17.0 line 803, and inspect the corresponding bake.yml workflow and metadata-action inputs. Trace how workflow inputs reach the build step, image/local outputs, and metadata labels or annotations. Done means both workflows support the proposed epoch behavior, including commit, and builds use consistent timestamps for layers and created metadata.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

Description
Problem

Docker's reproducible builds guide for GitHub Actions recommends setting SOURCE_DATE_EPOCH, for example to the commit time (git log -1 --pretty=%ct), on the build step. With the build reusable workflow, there's currently no way to get a reproducible image:

  • No input sets SOURCE_DATE_EPOCH for the build step. Passing it through build-args works for the image config and history timestamps, because BuildKit reads it as a build arg too. But the caller has to compute the commit time in a separate job, since the reusable workflow builds from the Git context without a checkout.
  • File timestamps inside the layers aren't rewritten. That needs rewrite-timestamp=true on the image exporter (BuildKit docs). The workflow builds the output string itself (build.yml#L803 at v1.17.0), so callers can't add it.
  • With set-meta-labels / set-meta-annotations, org.opencontainers.image.created gets the build time, because metadata-action uses the current date, even when SOURCE_DATE_EPOCH is set.

So two builds of the same commit always end up with different layer and image digests.

Proposal

A source-date-epoch input for build.yml (and bake.yml) that:

  1. sets SOURCE_DATE_EPOCH for the build step;
  2. adds rewrite-timestamp=true to the image (and local) output;
  3. uses the same time for the org.opencontainers.image.created label and annotation when set-meta-labels / set-meta-annotations are on.

It would help most if the input could also take the commit time directly, for example source-date-epoch: commit, since the workflow already knows which commit it builds and callers wouldn't need an extra job for it.

Alternatives considered
  • build-args: SOURCE_DATE_EPOCH=… plus overriding meta-labels / meta-annotations: fixes the metadata timestamps, but not the layer contents, so the digests still differ.
  • Using docker/build-push-action directly: works, but gives up what the reusable workflow provides (distributed native builds, signed cache, signed provenance).
Vorherrschende Sprache
Keine Sprachdaten
Sterne
87
Forks
23
Ø Merge
5 T. 47 Min.
Gemergte PRs (30 T.)
17

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus docker/github-builder

Alle Issues in docker/github-builder

Ähnliche Issues

Weitere Issues zu Build System

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.