docs: Document SOURCE_DATE_EPOCH for reproducible chart archives#2180
Conversation
Add a how-to section explaining how to set SOURCE_DATE_EPOCH to produce reproducible chart archives with helm package, including value semantics and the scope of the four other commands that honor it. relates to helm/helm#32162 Signed-off-by: promptless[bot] <promptless[bot]@users.noreply.github.com>
| ## Build Reproducible Chart Archives | ||
|
|
||
| By default, the files inside a packaged chart archive (`.tgz`) | ||
| carry the modification times of the source files on disk. |
There was a problem hiding this comment.
Documented that Helm honors SOURCE_DATE_EPOCH to stamp chart archive file modification times, based on PR #32162 which added sourceDateEpochFromEnv() in pkg/cmd/source_date_epoch.go and StampModTimes in pkg/chart/v2/chart.go, applied before archiving in pkg/action/package.go.
Source: helm/helm#32162
| Keep the following in mind when you use `SOURCE_DATE_EPOCH`: | ||
|
|
||
| - The value must be a non-negative integer. | ||
| Helm interprets it as whole seconds in UTC and does not support sub-second precision. |
There was a problem hiding this comment.
Value semantics come from sourceDateEpochFromEnv() in pkg/cmd/source_date_epoch.go: it parses the value with strconv.ParseInt as whole seconds and converts via time.Unix(epoch, 0).UTC(), returns nil for unset/empty, and errors with invalid SOURCE_DATE_EPOCH for non-numeric or negative values.
| - When the variable is unset or empty, | ||
| Helm keeps the default behavior, | ||
| where archive entries reflect the actual file modification times. | ||
| - `helm install`, `helm upgrade`, `helm dependency build`, and `helm dependency update` |
There was a problem hiding this comment.
The file://-only scope for install/upgrade/dependency build/dependency update reflects pkg/downloader/manager.go, where the epoch is passed into the download Manager but only applied inside tarFromLocalDir when re-archiving dependencies from a local file:// repository; remotely fetched dependency archives are stored unchanged.
…POCH Charts with a Chart.lock now produce byte-identical archives across builds when SOURCE_DATE_EPOCH is set, because the lockfile's generated: field is stamped with the same normalized (UTC, whole-second) timestamp. Refs helm/helm#32403, helm/helm#32396 Signed-off-by: promptless[bot] <promptless[bot]@users.noreply.github.com>
|
Just a reminder: If you'd like me to act on any feedback you have via Github comments, just type @Promptless in your suggestion and I'll get right on it! (I won't show up in the user dropdown, but I'll process any request that has @Promptless in the comment body.) |
2 participants
Open this suggestion in Promptless to view citations and reasoning process
Adds a "Build Reproducible Chart Archives" section to the Chart Development Tips and Tricks how-to, documenting how
SOURCE_DATE_EPOCHstamps archive file modification times viahelm package, its value semantics (non-negative integer seconds, UTC, error on invalid/negative), and the limited scope for install/upgrade/dependency commands. Covers helm/helm#32162.Trigger Events
Tip: Filter the Dashboard by labels or assignees to focus on what matters to you 🔎