diff --git a/pkg/action/package.go b/pkg/action/package.go index b8ee21c68..9da63553a 100644 --- a/pkg/action/package.go +++ b/pkg/action/package.go @@ -51,9 +51,12 @@ type Package struct { DependencyUpdate bool // SourceDateEpoch, when non-nil, overrides all tar entry modification times - // in the produced chart archive. Set by callers that want reproducible builds. - // The environment variable SOURCE_DATE_EPOCH is the conventional way to supply - // this value from the CLI; reading that variable is the CLI's responsibility. + // in the produced chart archive, and also overwrites the "generated" + // timestamp in Chart.lock (if present) since that value is both the lock + // file's own tar entry modtime and part of its marshaled YAML content. + // Set by callers that want reproducible builds. The environment variable + // SOURCE_DATE_EPOCH is the conventional way to supply this value from the + // CLI; reading that variable is the CLI's responsibility. SourceDateEpoch *time.Time RepositoryConfig string diff --git a/pkg/chart/v2/chart.go b/pkg/chart/v2/chart.go index adfaab15c..d24b3bded 100644 --- a/pkg/chart/v2/chart.go +++ b/pkg/chart/v2/chart.go @@ -110,6 +110,11 @@ func (ch *Chart) Dependencies() []*Chart { return ch.dependencies } // because tar headers have second-level granularity and timezone-independent // storage. This is used to produce reproducible archives when a build process // supplies a fixed timestamp (e.g. via SOURCE_DATE_EPOCH). +// +// If Lock is set, its Generated field is also overwritten with t. This is not +// just a tar header change: Generated is marshaled into Chart.lock's own YAML +// content, so this stamping is visible to anyone who reads the lock file out +// of the produced archive. func (ch *Chart) StampModTimes(t time.Time) { t = t.UTC().Truncate(time.Second) ch.ModTime = t