From 0ef7c25e15b05b44530e45e07350bafccdb629fb Mon Sep 17 00:00:00 2001 From: Ilya Kiselev Date: Wed, 24 Jun 2026 02:04:39 +0300 Subject: [PATCH] docs(package): document that SourceDateEpoch also rewrites Chart.lock's generated field Lock.Generated isn't just the tar entry modtime for Chart.lock, it's also marshaled into the lock file's own YAML content. Made that explicit on both the SourceDateEpoch field and chart.Chart.StampModTimes so it isn't a surprise to SDK consumers or future maintainers. Signed-off-by: Ilya Kiselev --- pkg/action/package.go | 9 ++++++--- pkg/chart/v2/chart.go | 5 +++++ 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/pkg/action/package.go b/pkg/action/package.go index b8ee21c68..9da63553a 100644 --- a/pkg/action/package.go +++ b/pkg/action/package.go @@ -51,9 +51,12 @@ type Package struct { DependencyUpdate bool // SourceDateEpoch, when non-nil, overrides all tar entry modification times - // in the produced chart archive. Set by callers that want reproducible builds. - // The environment variable SOURCE_DATE_EPOCH is the conventional way to supply - // this value from the CLI; reading that variable is the CLI's responsibility. + // in the produced chart archive, and also overwrites the "generated" + // timestamp in Chart.lock (if present) since that value is both the lock + // file's own tar entry modtime and part of its marshaled YAML content. + // Set by callers that want reproducible builds. The environment variable + // SOURCE_DATE_EPOCH is the conventional way to supply this value from the + // CLI; reading that variable is the CLI's responsibility. SourceDateEpoch *time.Time RepositoryConfig string diff --git a/pkg/chart/v2/chart.go b/pkg/chart/v2/chart.go index adfaab15c..d24b3bded 100644 --- a/pkg/chart/v2/chart.go +++ b/pkg/chart/v2/chart.go @@ -110,6 +110,11 @@ func (ch *Chart) Dependencies() []*Chart { return ch.dependencies } // because tar headers have second-level granularity and timezone-independent // storage. This is used to produce reproducible archives when a build process // supplies a fixed timestamp (e.g. via SOURCE_DATE_EPOCH). +// +// If Lock is set, its Generated field is also overwritten with t. This is not +// just a tar header change: Generated is marshaled into Chart.lock's own YAML +// content, so this stamping is visible to anyone who reads the lock file out +// of the produced archive. func (ch *Chart) StampModTimes(t time.Time) { t = t.UTC().Truncate(time.Second) ch.ModTime = t