WIP: Reproduce

.github/workflows/ci.yml

@@ -492,18 +492,9 @@ jobs:
           poetry run jinja2 Dockerfile.in Dockerfile.env > out
           diff Dockerfile out
 
-      - name: Get current date
+      - name: Build Dangerzone container image
-        id: date
+        run: |
-        run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
+          python3 ./install/common/build-image.py --no-save
-
-      - name: Restore container cache
-        uses: actions/cache/restore@v4
-        with:
-          key: v3-${{ steps.date.outputs.date }}-${{ hashFiles('Dockerfile', 'dangerzone/conversion/*.py', 'dangerzone/container/*', 'install/common/build-image.py') }}
-          path: |-
-            share/container.tar.gz
-            share/image-id.txt
-          fail-on-cache-miss: true
 
       - name: Reproduce the same container image
         run: |

.github/workflows/scan.yml

@@ -21,13 +21,17 @@ jobs:
           sudo apt install pipx
           pipx install poetry
           pipx inject poetry poetry-plugin-export
+          poetry install --only package
+      - name: Bump date of Debian snapshot archive
+        run: |
+          date=$(date "+%Y%m%d")
+          sed -i "s/DEBIAN_ARCHIVE_DATE=[0-9]\+/DEBIAN_ARCHIVE_DATE=${date}/" Dockerfile.env
+          poetry run jinja2 Dockerfile.in Dockerfile.env > Dockerfile
       - name: Build container image
         run: python3 ./install/common/build-image.py --runtime docker --no-save
       - name: Get image tag
         id: tag
-        run: |
+        run: echo "tag=$(cat share/image-id.txt)" >> $GITHUB_OUTPUT
-          tag=$(docker images dangerzone.rocks/dangerzone --format '{{ .Tag }}')
-          echo "tag=$tag" >> $GITHUB_OUTPUT
       # NOTE: Scan first without failing, else we won't be able to read the scan
       # report.
       - name: Scan container image (no fail)

dev_scripts/reproduce.py

@@ -36,7 +36,7 @@ def git_commit_get():
 def git_verify(commit, source):
     if not commit in source:
         raise RuntimeError(
-            f"Image '{image}' does not seem to be built from commit '{commit}'"
+            f"Image '{source}' does not seem to be built from commit '{commit}'"
         )