Commit 2869ce7 made xattr and bigfiles components clamp their mtimes to
file mtimes instead of the resolved created epoch, which fixed the
reproducibility of ancestor directories when file mtimes are canonical
(i.e. were explicitly set to a meaningful, fixed, value) but an epoch
wasn't explicitly set.
However, this breaks the case where an epoch _is_ explicitly passed. The
problem is that the file mtime may be arbitrary (e.g. if it's just
created with the current time at image build time, like the rpmdb),
which thus renders the image non-reproducible (even though
SOURCE_DATE_EPOCH has been passed!).
I think what we want is actually the `min()` of the file mtime and the
resolved epoch. That way, (1) if an SDE is passed in, and no mtime is
explicitly set on a file created at build time, it's reasonable to
expect it to be more recent than SDE and thus gets capped, but (2) if no
SDE is passed, then it defaults to $now, and it's reasonable to expect
any explicit mtime set on a bigfiles for reproducibility reasons to be
before $now, and thus the file mtime wins. In both cases, we're
basically picking the timestamp most likely to be stable.
This was actually part of an earlier version of PR #161, but I
mistakenly in review claimed that we could drop it:
https://github.com/coreos/chunkah/pull/161#discussion_r4037740157Fixes: #176
Assisted-by: AI
d861f167d3