Add timestamp validation to tarball files

[sylvestre]

Describe the bug
If I have my history correct, it is quite unlikely that we have any Rust file written during the 1970 years, we should have files with timestamp from these years.

To Reproduce

$ wget  https://crates.io/api/v1/crates/grep-cli/0.1.6/download 
$ tar zxvf download
$  ls -al grep-cli-0.1.6/Cargo.toml
-rw-r--r-- 1 sylvestre sylvestre 1404  1 janv.  1970 grep-cli-0.1.6/Cargo.toml

Expected behavior

crates.io should probably reject incorrect/invalid timestamps
(it is causing pain the Debian packaging side)

It was probably caused by:
rust-lang/cargo#9512

[Turbo87]

crates.io should probably reject incorrect/invalid timestamps

I'm not sure how we'd be able to tell if it's incorrect or not. 1970 sure sounds wrong, but where is the threshold?

[sylvestre]

2000 would be probably good enough.

[Turbo87]

maybe, but I'm not sure what the difference is between 1970 being wrong and 2000 being wrong 🤔

[sylvestre]

Avoid some Debian errors like:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=976369
(I know it isn't the best argument ever :)

[JohnTitor]

I've made Cargo use tar v0.4.38 which includes alexcrichton/tar-rs#262, but some files still have 1970-01-01 including Cargo.toml:

[~/ws/semverver-0.1.51]$ ls -al
total 104
drwxr-xr-x  5 koybi koybi  4096 Jun 23 20:28 .
drwxr-xr-x 19 koybi koybi  4096 Jun 23 20:28 ..
-rw-r--r--  1 koybi koybi   200 Jul 24  2006 build.rs
-rw-r--r--  1 koybi koybi 33025 Jan  1  1970 Cargo.lock
-rw-r--r--  1 koybi koybi  1571 Jan  1  1970 Cargo.toml
-rw-r--r--  1 koybi koybi  1131 Jul 24  2006 Cargo.toml.orig
-rw-r--r--  1 koybi koybi    94 Jan  1  1970 .cargo_vcs_info.json
-rw-r--r--  1 koybi koybi  1842 Jul 24  2006 CONTRIBUTING.md
-rw-r--r--  1 koybi koybi    67 Jul 24  2006 .gitattributes
-rw-r--r--  1 koybi koybi    41 Jul 24  2006 .gitignore
-rw-r--r--  1 koybi koybi  1540 Jul 24  2006 LICENSE
-rw-r--r--  1 koybi koybi 10167 Jul 24  2006 README.md
-rw-r--r--  1 koybi koybi   141 Jul 24  2006 rust-toolchain
drwxr-xr-x  2 koybi koybi  4096 Jun 23 20:28 scripts
drwxr-xr-x  3 koybi koybi  4096 Jun 23 20:28 src
drwxr-xr-x  5 koybi koybi  4096 Jun 23 20:28 tests

Maybe some files' mtimes are set to 1 by https://github.com/alexcrichton/tar-rs/blob/f4f439ca0cd3a984d2a66fb8e42f6e2307876afd/src/entry.rs#L475?

[JohnTitor]

While I think it's reasonable to prefer a newer timestamp, I'm not sure if we should validate and reject it on crates.io. If I understand correctly, it would reject many old Cargo versions, no?

[Turbo87]

yeah, I tend to agree. we shouldn't reject these files, but we should ideally fix this on the cargo side (or whereever the issue exists)