Merge pull request #129 from stefanprodan/reproducible-builds

Enabled reproducible builds of OCI artifacts

cmd/timoni/log.go

@@ -18,6 +18,7 @@ package main
 
 import (
 	"context"
+	"io"
 	"os"
 	"time"
 
@@ -42,8 +43,8 @@ func NewConsoleLogger(pretty bool) logr.Logger {
 
 	zlog := zerolog.New(zconfig).With().Timestamp().Logger()
 
-	// Set container registry client logger.
-	gcrLog.Warn.SetOutput(zlog)
+	// Discard the container registry client logger.
+	gcrLog.Warn.SetOutput(io.Discard)
 
 	// Create a logr.Logger using zerolog as sink.
 	zerologr.VerbosityFieldName = ""

cmd/timoni/mod_push.go

@@ -22,7 +22,9 @@ import (
 	"fmt"
 	"os"
 	"os/exec"
+	"strconv"
 	"strings"
+	"time"
 
 	"github.com/Masterminds/semver/v3"
 	oci "github.com/fluxcd/pkg/oci/client"
@@ -116,16 +118,7 @@ func pushModCmdRun(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("module not found at path %s", pushModArgs.module)
 	}
 
-	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
-	defer cancel()
-
-	if pushModArgs.source == "" {
-		gitCmd := exec.CommandContext(ctx, "git", "config", "--get", "remote.origin.url")
-		gitCmd.Dir = pushModArgs.module
-		if repo, err := gitCmd.Output(); err == nil && len(repo) > 1 {
-			pushModArgs.source = strings.TrimSuffix(string(repo), "\n")
-		}
-	}
+	log := LoggerFrom(cmd.Context())
 
 	annotations := map[string]string{}
 	for _, annotation := range pushModArgs.annotations {
@@ -144,6 +137,30 @@ func pushModCmdRun(cmd *cobra.Command, args []string) error {
 		Annotations: annotations,
 	}
 
+	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
+	defer cancel()
+
+	// Try to determine the Git origin URL
+	if pushModArgs.source == "" {
+		gitCmd := exec.CommandContext(ctx, "git", "config", "--get", "remote.origin.url")
+		gitCmd.Dir = pushModArgs.module
+		if repo, err := gitCmd.Output(); err == nil && len(repo) > 1 {
+			pushModArgs.source = strings.TrimSuffix(string(repo), "\n")
+			log.Info(fmt.Sprintf("Setting the module source to: %s", pushModArgs.source))
+		}
+	}
+
+	// Try to determine the last Git commit timestamp
+	gitCmd := exec.CommandContext(ctx, "git", "--no-pager", "log", "-1", `--format=%ct`)
+	gitCmd.Dir = pushModArgs.module
+	if ts, err := gitCmd.Output(); err == nil && len(ts) > 1 {
+		if i, err := strconv.ParseInt(strings.TrimSuffix(string(ts), "\n"), 10, 64); err == nil {
+			d := time.Unix(i, 0)
+			meta.Created = d.Format(time.RFC3339)
+			log.Info(fmt.Sprintf("Setting the module created timestamp to: %s", meta.Created))
+		}
+	}
+
 	if pushModArgs.creds != "" {
 		if err := ociClient.LoginWithCredentials(pushModArgs.creds.String()); err != nil {
 			return fmt.Errorf("could not login with credentials: %w", err)
@@ -204,7 +221,7 @@ func pushModCmdRun(cmd *cobra.Command, args []string) error {
 		}
 		cmd.OutOrStdout().Write(marshalled)
 	default:
-		cmd.OutOrStdout().Write([]byte(digestURL + "\n"))
+		log.Info(fmt.Sprintf("Module pushed to: %s", digestURL))
 	}
 
 	return nil

go.mod

@@ -6,35 +6,35 @@ require (
 	cuelang.org/go v0.5.0
 	github.com/Masterminds/semver/v3 v3.2.1
 	github.com/briandowns/spinner v1.23.0
-	github.com/distribution/distribution/v3 v3.0.0-20230519140516-983358f8e250
-	github.com/fluxcd/pkg/oci v0.27.0
+	github.com/distribution/distribution/v3 v3.0.0-20230621170613-87b280718d38
+	github.com/fluxcd/pkg/oci v0.28.0
 	github.com/fluxcd/pkg/sourceignore v0.3.4
-	github.com/fluxcd/pkg/ssa v0.28.1
+	github.com/fluxcd/pkg/ssa v0.28.2
 	github.com/go-logr/logr v1.2.4
 	github.com/go-logr/zerologr v1.2.3
 	github.com/gonvenience/ytbx v1.4.4
 	github.com/google/go-containerregistry v0.15.2
 	github.com/homeport/dyff v1.5.7
 	github.com/mattn/go-shellwords v1.0.12
 	github.com/olekukonko/tablewriter v0.0.5
-	github.com/onsi/gomega v1.27.7
-	github.com/otiai10/copy v1.11.0
+	github.com/onsi/gomega v1.27.8
+	github.com/otiai10/copy v1.12.0
 	github.com/phayes/freeport v0.0.0-20220201140144-74d24b5ae9f5
 	github.com/rs/zerolog v1.29.1
-	github.com/sirupsen/logrus v1.9.2
+	github.com/sirupsen/logrus v1.9.3
 	github.com/spf13/cobra v1.7.0
-	k8s.io/api v0.27.2
-	k8s.io/apiextensions-apiserver v0.27.2
-	k8s.io/apimachinery v0.27.2
-	k8s.io/cli-runtime v0.27.2
-	k8s.io/client-go v0.27.2
+	k8s.io/api v0.27.3
+	k8s.io/apiextensions-apiserver v0.27.3
+	k8s.io/apimachinery v0.27.3
+	k8s.io/cli-runtime v0.27.3
+	k8s.io/client-go v0.27.3
 	sigs.k8s.io/cli-utils v0.34.0
 	sigs.k8s.io/controller-runtime v0.15.0
 	sigs.k8s.io/yaml v1.3.0
 )
 
 require (
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.6.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.6.1 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.3.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/internal v1.3.0 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
@@ -43,18 +43,18 @@ require (
 	github.com/MakeNowJust/heredoc v1.0.0 // indirect
 	github.com/Shopify/logrus-bugsnag v0.0.0-20171204204709-577dee27f20d // indirect
 	github.com/acomagu/bufpipe v1.0.4 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.18.0 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.18.25 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.13.24 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.3 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.33 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.27 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.34 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ecr v1.18.11 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.27 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.12.10 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.10 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.19.0 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.18.1 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.18.27 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.13.26 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.4 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.34 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.28 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.35 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ecr v1.18.13 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.28 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.12.12 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.12 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.19.2 // indirect
 	github.com/aws/smithy-go v1.13.5 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bshuster-repo/logrus-logstash-hook v1.0.0 // indirect
@@ -181,7 +181,7 @@ require (
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/component-base v0.27.2 // indirect
+	k8s.io/component-base v0.27.3 // indirect
 	k8s.io/klog/v2 v2.90.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f // indirect
 	k8s.io/kubectl v0.25.4 // indirect