Buildah: "created" timestamp not in UTC breaks reproducibility

[tensor5]

Description

I'm trying to build a reproducible image using buildah commit --omit-timestamp, but the timestamp in the "created" field of the image configuration JSON is not in UTC form and shows my current timezone

1970-01-01T09:00:00+09:00

vs

1970-01-01T00:00:00Z

thus breaking reproducibility.

Steps to reproduce the issue:

1. ctr=$(buildah from scratch)
2. buildah commit --omit-timestamp $ctr
   3.

Describe the results you received:

$ cat vfs-images/c14f2fddfca46e8bf9e3c88bde452b30d3f4360e9c44b22e4f2372e4e00d45e6/'=c2hhMjU2OmMxNGYyZmRkZmNhNDZlOGJmOWUzYzg4YmRlNDUyYjMwZDNmNDM2MGU5YzQ0YjIyZTRmMjM3MmU0ZTAwZDQ1ZTY=' | jq .
{
  "created": "1970-01-01T09:00:00+09:00",
  "architecture": "amd64",
  "os": "linux",
  "config": {
    "Labels": {
      "io.buildah.version": "1.15.1"
    }
  },
  "rootfs": {
    "type": "layers",
    "diff_ids": [
      "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef"
    ]
  },
  "history": [
    {
      "created": "1970-01-01T09:00:00+09:00",
      "created_by": "/bin/sh"
    }
  ]
}

Describe the results you expected:

$ cat vfs-images/c14f2fddfca46e8bf9e3c88bde452b30d3f4360e9c44b22e4f2372e4e00d45e6/'=c2hhMjU2OmMxNGYyZmRkZmNhNDZlOGJmOWUzYzg4YmRlNDUyYjMwZDNmNDM2MGU5YzQ0YjIyZTRmMjM3MmU0ZTAwZDQ1ZTY=' | jq .
{
  "created": "1970-01-01T00:00:00Z",
  "architecture": "amd64",
  "os": "linux",
  "config": {
    "Labels": {
      "io.buildah.version": "1.15.1"
    }
  },
  "rootfs": {
    "type": "layers",
    "diff_ids": [
      "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef"
    ]
  },
  "history": [
    {
      "created": "1970-01-01T00:00:00Z",
      "created_by": "/bin/sh"
    }
  ]
}

Output of buildah version:

buildah version 1.15.1 (image-spec 1.0.1-dev, runtime-spec 1.0.2-dev)

[rhatdan]

Could you check this against the upstream packages. We might have fixed it. We now add all of the content with EPOCH time as well. For any layer added to the base image.

[tensor5]

Tried quay.io/buildah/upstream and it works.

# ln -sf ../usr/share/zoneinfo/Asia/Tokyo /etc/localtime
# ctr=$(buildah from --storage-driver vfs  scratch)
# buildah commit --storage-driver vfs --omit-timestamp $ctr
# cat /var/lib/containers/storage/vfs-images/ef5448ab7e3339a9ef7b110b8c839b731e00e056c68ab86ad57414d27c4579a5/'=c2hhMjU2OmVmNTQ0OGFiN2UzMzM5YTllZjdiMTEwYjhjODM5YjczMWUwMGUwNTZjNjhhYjg2YWQ1NzQxNGQyN2M0NTc5YTU='

[nalind]

Yeah, pretty sure this was fixed by #2539.

[TomSweeneyRedHat]

What @nalind said. Given that, I'm going to close this issue. @tensor5 feel free to reopen or create a new issue if this problem persists.

[tensor5]

Thanks!
By the way, I wrote a blog post on how to build reproducible container images with Buildah; I used buildah mount at the moment, but I will update it to buildah bud --omit-timestamp when the new version is released.

[TomSweeneyRedHat]

@tensor5 thanks for the blog post link. I'll add a link to it from buildah.io

[rhatdan]

@tensor5 PTAL https://github.com/containers/buildah/pull/2571
We have switched option to allow users to specify the EPOCH time. Rather then force to 0.

That way you can record the first time you built an image via the EPOCH and, now you can rebuild based on that time.

[tensor5]

@rhatdan
Tried --timestamp=0 and it works. Thanks.