Reproducible Builds

[tri-adam]

Refactor github.com/sylabs/sif/v2/internal/pkg/git to expose (*Description).CommitTime. Remove (*Description).Reference() and add (*Description).CommitHash() in its place.

Ensure builds are reproducible by:

• Using (*Description).CommitTime as main.date for mage builds when the working directory is clean.
• Disabling CGO in mage builds.
• Use -trimpath in mage/goreleaser builds.

Harmonize linker flags used by mage/goreleaser by adding -s -w to mage build/install commands.

Use Date: rather than Built: in siftool version output to clarify semantics of this value (in clean builds, main.date is the commit date rather than the build date.

Closes #156

[codecov-commenter]

Codecov Report

Merging #157 (d66d8b5) into master (8a9449e) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master     #157   +/-   ##
=======================================
  Coverage   75.27%   75.27%           
=======================================
  Files          28       28           
  Lines        2419     2419           
=======================================
  Hits         1821     1821           
  Misses        459      459           
  Partials      139      139           

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 8a9449e...d66d8b5. Read the comment docs.

[dtrudg]

Confirmed repeatable on my system. Since we are not static / CGO is in use, not repeatable across systems with different ld and basic libs.

[tri-adam]

Confirmed repeatable on my system. Since we are not static / CGO is in use, not repeatable across systems with different ld and basic libs.

Good point. Since the goreleaser build is disabling CGO, I've gone ahead and done so for mage build and mage install.