Support reproducible builds with SOURCE_DATE_EPOCH
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 新手友好度
- 52/100
- Issue 类型
- 功能
- 描述清晰度
- 基本清楚
- 活跃度
- 活跃
- 技术栈
- docker, github-actions
- 领域
- build-system, ci-cd
调研方向
Start with .github/workflows/build.yml, especially the output construction at the referenced v1.17.0 line 803, and inspect the corresponding bake.yml workflow and metadata-action inputs. Trace how workflow inputs reach the build step, image/local outputs, and metadata labels or annotations. Done means both workflows support the proposed epoch behavior, including commit, and builds use consistent timestamps for layers and created metadata.
由索引模型根据 Issue 内容生成。
描述
Description
Problem
Docker's reproducible builds guide for GitHub Actions recommends setting SOURCE_DATE_EPOCH, for example to the commit time (git log -1 --pretty=%ct), on the build step. With the build reusable workflow, there's currently no way to get a reproducible image:
- No input sets
SOURCE_DATE_EPOCHfor the build step. Passing it throughbuild-argsworks for the image config and history timestamps, because BuildKit reads it as a build arg too. But the caller has to compute the commit time in a separate job, since the reusable workflow builds from the Git context without a checkout. - File timestamps inside the layers aren't rewritten. That needs
rewrite-timestamp=trueon the image exporter (BuildKit docs). The workflow builds the output string itself (build.yml#L803 at v1.17.0), so callers can't add it. - With
set-meta-labels/set-meta-annotations,org.opencontainers.image.createdgets the build time, because metadata-action uses the current date, even whenSOURCE_DATE_EPOCHis set.
So two builds of the same commit always end up with different layer and image digests.
Proposal
A source-date-epoch input for build.yml (and bake.yml) that:
- sets
SOURCE_DATE_EPOCHfor the build step; - adds
rewrite-timestamp=trueto theimage(andlocal) output; - uses the same time for the
org.opencontainers.image.createdlabel and annotation whenset-meta-labels/set-meta-annotationsare on.
It would help most if the input could also take the commit time directly, for example source-date-epoch: commit, since the workflow already knows which commit it builds and callers wouldn't need an extra job for it.
Alternatives considered
build-args: SOURCE_DATE_EPOCH=…plus overridingmeta-labels/meta-annotations: fixes the metadata timestamps, but not the layer contents, so the digests still differ.- Using
docker/build-push-actiondirectly: works, but gives up what the reusable workflow provides (distributed native builds, signed cache, signed provenance).
- 主要语言
- 没有语言数据
- 星标
- 87
- 派生
- 23
- 平均合并
- 5 天 47 分钟
- 30 天内合并 PR
- 17
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
docker/github-builder 的其他 Issue
-
难度 4/5 3-5 天 新手友好度 52/100
docker/github-builder#251 ·
维护者通常 1 天内回复
-
难度 3/5 1-2 天 新手友好度 68/100
docker/github-builder#209 ·
维护者通常 1 天内回复
-
kind/enhancement
难度 3/5 1-2 天 新手友好度 65/100
docker/github-builder#207 · 1 条评论 ·
维护者通常 1 天内回复
-
kind/enhancement status/triage
难度 5/5 一周以上 新手友好度 25/100
docker/github-builder#203 · 1 条评论 ·
维护者通常 1 天内回复
-
status/triage
难度 4/5 3-5 天 新手友好度 45/100
docker/github-builder#193 · 2 条评论 ·
维护者通常 1 天内回复
查看 docker/github-builder 的全部 Issue
相似的 Issue
-
AssignTargetPath does not recognize forward slashes in relative path specifiers可能已有人在做 @AustinAviv 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 79/100
维护者通常 2 天内回复
-
out-of-date
难度 1/5 1 小时以内 新手友好度 65/100
CachyOS/CachyOS-PKGBUILDS#1981 ·
维护者通常 1 天内回复
-
[Bug] Dev image build fails: `npm install` in the root Dockerfile runs out of memory (exit 134)可能已有人在做 @andest01 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 75/100
维护者通常 1 天内回复
-
100 points complexity:trivial drips-wave enhancement good first issue trivial
难度 2/5 1-3 小时 新手友好度 68/100
sorotrail/SoroBeacon#438 ·
维护者通常 1 天内回复
-
area: backend bug
难度 2/5 1-3 小时 新手友好度 68/100
snapotter-hq/SnapOtter#2415 ·
维护者通常 1 天内回复