Added

• umoci stat now includes information about the manifest and configuration of the image, both in the regular and JSON-formatted outputs.

• umoci now has SOURCE_DATE_EPOCH support, to attempt to make it easier to create reproducible images. Our behaviour is modelled after tar --clamp-mtime, meaning that SOURCE_DATE_EPOCH will only be used to modify the timestamps of files newer than SOURCE_DATE_EPOCH.

  As umoci repack works based on diffs, this also means that only files that were modified (and will thus be usually be included in the new layer) will have their timestamps rewritten.

  --history.created and umoci config --created will also now default to SOURCE_DATE_EPOCH (if set).

  With this change, umoci should be fairly compliant with reproducible builds. Please let us know if you find any other problematic areas in umoci (we are investigating some other possible causes of instability such as Go map iteration).

• In order to avoid the need for a patched gomtree package that supports rootless mode, umoci now has a umoci raw mtree-validate subcommand that implements the key gomtree validate features we need for our integration tests.

  Note that this subcommand is not intended for wider use outside of our tests (and it is hidden from the help pages for a reason). Most users are probably better off just using gomtree.

• umoci --version now provides more information about the specification versions supported by the umoci binary as well as the Go version used.

• umoci config now supports specifying the architecture variant of the image with --platform.variant. In addition, --os and --architecture can now be set using --platform.os and --platform.arch respectively.

• umoci new will not automatically fill the architecture variant on ARM systems to match the host CPU.

Changed

• The output format of umoci stat has had some minor changes made to how special characters are escaped and when quoting is carried out.

Fixed

• Some minor aspects of how umoci stat would filter special characters in history entries have been resolved.
• umoci repack will now truncate the mtime of files added to the layer tar archives. Previously, we would defer to the Go stdlib's archive/tar which rounds to the nearest second (which is incompatible with gomtree and so in theory could lead to inconsistent results).
• Previously, when generating the runtime-spec config.json, umoci unpack would incorrectly prioritise the automatically generated annotations over explicitly configured labels. This precdence was the opposite of what the image-spec requires, and has now been resolved.

Thanks to the following contributors for making this release possible:

• Aleksa Sarai cyphar@cyphar.com
• Danish Prakash contact@danishpraka.sh

Signed-off-by: Aleksa Sarai cyphar@cyphar.com