diff --git a/internal/devbox/devbox.go b/internal/devbox/devbox.go index 4c3f82421ce..cbf55f5b129 100644 --- a/internal/devbox/devbox.go +++ b/internal/devbox/devbox.go @@ -1079,8 +1079,9 @@ var ignoreCurrentEnvVar = map[string]bool{ // ignoreDevEnvVar contains environment variables that Devbox should remove from // the slice of [Devbox.PrintDevEnv] variables before sourcing them. // -// This list comes directly from the "nix develop" source: +// Most of this list comes directly from the "nix develop" source: // https://github.com/NixOS/nix/blob/f08ad5bdbac02167f7d9f5e7f9bab57cf1c5f8c4/src/nix/develop.cc#L257-L275 +// Entries not in that list are called out below. var ignoreDevEnvVar = map[string]bool{ "BASHOPTS": true, "HOME": true, @@ -1091,13 +1092,28 @@ var ignoreDevEnvVar = map[string]bool{ "PPID": true, "SHELL": true, "SHELLOPTS": true, - "TEMP": true, - "TEMPDIR": true, - "TERM": true, - "TMP": true, - "TMPDIR": true, - "TZ": true, - "UID": true, + + // SOURCE_DATE_EPOCH is set by the nixpkgs stdenv to a fixed timestamp + // (315532800 = 1980-01-01) so that *builds* are reproducible. Leaking it + // into the interactive Devbox shell makes any timestamp-respecting tool run + // there stamp its output with 1980 instead of the current time. The most + // visible symptom is Docker images showing up as created "45 years ago" + // (which can trip age-based registry cleanup), but it also affects tar, + // gzip, and other build tools. Ignore the Nix-provided value so the shell + // falls back to the current environment (normally unset, so tools use the + // real time). Users who genuinely want reproducible builds can still set + // SOURCE_DATE_EPOCH explicitly via devbox.json's env block, which is layered + // on top of these variables. See + // https://github.com/jetify-com/devbox/issues/2597. + "SOURCE_DATE_EPOCH": true, + + "TEMP": true, + "TEMPDIR": true, + "TERM": true, + "TMP": true, + "TMPDIR": true, + "TZ": true, + "UID": true, } func (d *Devbox) ProjectDirHash() string { diff --git a/testscripts/run/source_date_epoch.test.txt b/testscripts/run/source_date_epoch.test.txt new file mode 100644 index 00000000000..2a586458e8b --- /dev/null +++ b/testscripts/run/source_date_epoch.test.txt @@ -0,0 +1,15 @@ +# The nixpkgs stdenv sets SOURCE_DATE_EPOCH to a fixed timestamp +# (315532800 = 1980-01-01) so that builds are reproducible. Devbox must not +# leak that value into the interactive shell, otherwise timestamp-respecting +# tools (docker build, tar, gzip, ...) stamp their output with 1980 -- e.g. +# Docker images show up as created "45 years ago". See +# https://github.com/jetify-com/devbox/issues/2597. + +exec devbox run echo 'epoch=<$SOURCE_DATE_EPOCH>' +stdout 'epoch=<' +! stdout '315532800' + +-- devbox.json -- +{ + "packages": [] +}