Reproducible builds

[martinetd]

Hello,

in order to generate delta updates I've been looking at making the archive generated by alpine-make-rootfs reproducible today.

In my experience there are two places that weren't reproducible:

• apk creates /lib/apk/db/scripts.tar when installing packages. apk respects SOURCE_DATE_EPOCH so setting that appropriately works and is enough. (more on the variable later)
• the tar generated by the script has quite a few variable informations. It's well explained in https://reproducible-builds.org/docs/archives/ ; basically we "just" need to add --sort=name --mtime=@$SOURCE_DATE_EPOCH --clamp-mtime --pax-option=exthdr.name=%d/PaxHeaders/%f,delete=atime,delete=ctime to the tar creation line.

Now the big question is what would SOURCE_DATE_EPOCH should be. The simplest approach is to say, if it's set from outside of alpine-make-rootfs we should just use it (that is true even if we add some detection later), so we probably should add the tar creation option conditionally on that.

As for setting it automatically, I think we could fetch the APKINDEX of the repos we're installing from and taking the latest timestamp in there... It's a bit annoying because we need to set it before running apk, and apk is the one getting the APKINDEX, so it's a bit of a chicken and egg problem... I need to check if we can just regenerate scripts.db later maybe...

What do you think?