Enable configuring the date used by reproducible builds

[dmikusa]

Description

Presently when you build an image, all of the timestamps are zeroed out, which gives you a date like "41 years ago" for your images.

1. This is a confusion point for new users. Where does this date come from? Why is pack doing this? Why don't I see the actual date when I built my image?
2. It is inconvenient in a number of cases. Like if you are trying to compare two different image builds, there is no date by which to sort them. You need to keep track of the specific image hashes, not practical and not the way a human brain works.

Proposed solution

Three suggestions:

1. Allow pack build to take as input the timestamp it should use. Instead of writing 0 as the timestamp, write this value.
2. By default, pack build will use the current timestamp and include that as a label on the image.
3. Add a config setting for pack that users could customize if they want it to be zero by default or the current timestamp.

This would achieve a couple of things:

1. You're still consistently overwriting the timestamps on everything, which should achieve the same goal for reproducible builds.
2. The date on the image will appear to be the current time by default which is what people expect.
3. You can still reproduce an image build by taking the build timestamp from the label on the image you are trying to reproduce and passing that into pack build.
4. You can still use 0. In fact, other platforms like kpack could ignore this and continue using zero as the default.

Describe alternatives you've considered

The current solution is where it always writes a 0 timestamp.

Additional context

• This feature should be documented somewhere. Yes. It would need to be documented in the pack documentation & reproducible build documentation.

Apologizes in advance if this is in the wrong repo. I wasn't entirely sure where to file this. Thanks!

[natalieparellano]

Related PR: buildpacks/imgutil#137

[natalieparellano]

Blocking this on lifecycle 0.14.0. Once that is released, pack will need to be updated to accept a new flag (--use-current-time? something else?) and set SOURCE_DATE_EPOCH in the lifecycle's environment.

[jromero]

Just throwing out some ideas but is there a way to have a single flag like --date-time that support both human-friendly value of now as well as seconds since epoch (date +%s).

Examples

# using human-friendly option
pack build ... --date-time now

# using `date` command
pack build ... --date-time $(date +%s)

# user desired time (in seconds)
pack build ... --date-time $my_special_time