Support reproducible builds (except packages)

[AkihiroSuda]

See:

• docker-library/official-images#16044

---

• SOURCE_DATE_EPOCH is added. The value is consumed by the build scripts to make the binary reproducible.

• For Debian, /var/log/* is removed as they contain timestamps

• For Debian, /var/cache/ldconfig/aux-cache is removed as they contain inode numbers, etc.

• For Alpine, virtual package versions are pinned to "0" to eliminate the timestamp-based version numbers that appear in /etc/apk/world and /lib/apk/db/installed

[!NOTE] The following topics are NOT covered by this commit:

• To reproduce file timestamps in layers, BuildKit has to be executed with --output type=<TYPE>,rewrite-timestamp=true. Needs BuildKit v0.13 or later.

• To reproduce the base image by the hash, reproducers may:

  • modify the FROM instruction in Dockerfile manually
  • or, use the CONVERT action of source policies to replace the base image. https://github.com/moby/buildkit/blob/v0.13.2/docs/build-repro.md

• To reproduce packages, see the RUN instruction hook proposed in moby/buildkit#4576

Also, Alpine-based images still have the following diff:

diff -ur /tmp/foo/diff/input-0/layers-3/lib/apk/db/installed /tmp/foo/diff/input-1/layers-3/lib/apk/db/installed
--- /tmp/foo/diff/input-0/layers-3/lib/apk/db/installed 2024-04-26 07:07:33.000000000 +0900
+++ /tmp/foo/diff/input-1/layers-3/lib/apk/db/installed 2024-04-26 07:07:33.000000000 +0900
@@ -1,4 +1,4 @@
-C:Q1z4Lv7mwS00FpNJwDUHdH70eM2ic=
+C:Q1gHSJHNX/rtq0yNsVTKaNb96s8Mk=
 P:.ruby-rundeps
 V:0
 A:noarch