Support reproducible builds (except packages)

[AkihiroSuda]

See:

• docker-library/official-images#16044

• SOURCE_DATE_EPOCH is added. The value is consumed by the build scripts to make the binary reproducible.

• For Alpine, virtual package versions are pinned to "0" to eliminate the timestamp-based version numbers that appear in /etc/apk/world and /lib/apk/db/installed

[!NOTE] The following topics are NOT covered by this commit:

• To reproduce file timestamps in layers, BuildKit has to be executed with --output type=<TYPE>,rewrite-timestamp=true. Needs BuildKit v0.13 or later.

• To reproduce the base image by the hash, reproducers may:

  • modify the FROM instruction in Dockerfile manually
  • or, use the CONVERT action of source policies to replace the base image. https://github.com/moby/buildkit/blob/v0.13.2/docs/build-repro.md

• To reproduce packages, see the RUN instruction hook proposed in moby/buildkit#4576

[AkihiroSuda]

ping 🙇‍♂️ @tianon