Resolves #522 set Created date to time of execution

[Lerentis]

Summary

This commit sets the Created date of the signature to the date of execution of the signing action.

Release Note

-changed: Signatures do now use the created timestamp based on the local time of signing

Documentation

n/a

[imjasonh]

This mostly lgtm, aside from the one tiny style nit.

A couple more questions though:

• Is there any kind of test we can add to check that the created date isn't zero?
• Do we also want this for attestations, SBOMs, etc?

[Lerentis]

• Is there any kind of test we can add to check that the created date isn't zero?

for a test like this one would need to mock a timestamp right? i am still learning when it comes to writing tests, so i fear this is out of my skill level as of now :/

• Do we also want this for attestations, SBOMs, etc?

would make sense to keep this consistent imo, but maybe i am missing some greater context why it was implemented with this fixed date stamp before

[imjasonh]

• Is there any kind of test we can add to check that the created date isn't zero?

for a test like this one would need to mock a timestamp right? i am still learning when it comes to writing tests, so i fear this is out of my skill level as of now :/

I don't know about everyone, but I'd personally accept a test that just checks that the created date is non-zero. Bonus points for it being any time in the last minute. Having a test that injects a fake timestamp and checks that it's exactly that date seems like overkill, but that's subjective.

• Do we also want this for attestations, SBOMs, etc?

would make sense to keep this consistent imo, but maybe i am missing some greater context why it was implemented with this fixed date stamp before

Yeah I think we should stay consistent.

The reason it was zero before was probably some combination of (a) that was the default when using empty.Image and mutate.Append, and (b) some vague idea that the signatures should be reproducible, so that if two clients signed the same artifact with the same signature at different times they should produce the same layer bytes. But for (b) at least, that doesn't really make sense, since those two signatures would never be the same anyway.

[codecov-commenter]

Codecov Report

Merging #2108 (5325d71) into main (5b57154) will increase coverage by 0.07%.
The diff coverage is 100.00%.

@@            Coverage Diff             @@
##             main    #2108      +/-   ##
==========================================
+ Coverage   26.27%   26.35%   +0.07%     
==========================================
  Files         129      129              
  Lines        7574     7582       +8     
==========================================
+ Hits         1990     1998       +8     
  Misses       5329     5329              
  Partials      255      255              

Impacted Files	Coverage Δ
pkg/oci/mutate/signatures.go	38.88% <100.00%> (+4.88%)	⬆️
pkg/oci/static/file.go	73.52% <100.00%> (+3.52%)	⬆️

Help us with your feedback. Take ten seconds to tell us how you rate us.

[Lerentis]

@imjasonh i hope i understood the requested changes correctly. initially i thought you were talking about a unit test and not a check about the previous date that was set 😅

[imjasonh]

@imjasonh i hope i understood the requested changes correctly. initially i thought you were talking about a unit test and not a check about the previous date that was set 😅

Oh I meant we should have a unit test that when a signature/whatever gets appended, it also updates the image's created-at date to be something recent, or at least non-zero.

I think we should always update the image's created-at to be Now(), otherwise if I sign something today and wait 90 days and sign it again, the created-at date will be 90 days ago and Gitlab might housekeep it.

[Lerentis]

ah okay then my initial understanding was correct. sorry about that.
added a simple zero unit test

[imjasonh]

This looks good!

I can't approve your CI run, but except for a few minor comments, this should be good to go assuming tests pass.

[imjasonh]

Only tiny tiny nits left, otherwise LGTM