Reproducible image builds

[sclevine]

The current lifecycle implementation enables buildpacks to perform reproducible image builds by:

1. Clearing the FS timestamps of all the copied app files before the build starts
2. Clearing the tar archive timestamps in each exported layer

Reproducible image builds is a key feature of CNB that other OCI image building solutions (like Dockerfiles) lack. We should add this to the spec!

Note: I suggest we set all times to one second after the epoch (like jib does) to avoid unusual behavior when timestamps are zero.

[nebhale]

Improvement 1 seems to preclude the avoidance of a build (specifically of a compilation step) based on timestamp changes. We do make use of this kind of avoidance, although if you think that the benefits from this outweigh the performance improvements at build time, I’d be willing to give it up.

[sclevine]

We already implement both of these behaviors in the lifecycle. Let's chat about the timestamp-based re-build avoidance. I want to understand how that works in different scenarios (e.g., re-buliding using a fresh clone from a git repo without timestamps).

[nebhale]

Post discussion I'm fine with the changes.

[jromero]

Given that this issue is in spec, is there an intent to formalize this as part of the spec or is it simply an extended feature of pack and the lifecycle? FWIW, it's documented in the docs via buildpacks/docs#123

[zmackie]

Happy to close it!

[ekcasey]

Resolved by #111