My Favorite npm Commit

If you are a package manager, it's important to be able to perform a reproducible build. That is, the same contents should result in the same artifact, always.

One of the biggest challenges to this is that files have timestamps indicating when they were changed, created, modified, and so on. While one could argue that changing the ctime or mtime of a file is a "change" to the contents, git (like most other source control systems) does not view it that way, gleefully letting the timestamps be whatever the system decides they should be.

So, if you are packing your artifacts in a format that tracks file times, you have to filter those out.

npm has used tar forever, and what we used to do is set the mtime and ctime fields in the tar header to 0, ie, 1970-01-01T00:00:00Z, the start of the Unix Epoch.

This was fine, for many years, but people complained that this broke some zip programs, which became increasingly relevant as Docker uses the zip archive format. The zip format does not support any file timestamps with dates prior to 1980-01-01.

So, instead of just setting all mtime and ctime values to 0, we needed to pick a date after 1980-01-01.

We considered using 1980-01-01T00:00:00Z. But since setting file timestamps to an arbitrary date in the past is, in a way, a form of time travel, we did this instead.

There are, today, billions of files in many millions of artifacts on the npm registry, each one bearing an homage to one of the greatest films of all time. Think of Marty and Doc Brown every time you look in your node_modules folder and wonder why all the file timestamps are from 1985.