new command: rebuild

[imjasonh]

This adds a new top-level command, melange rebuild, which takes an existing APK (or multiple), and extracts the .melange.yaml and .PKGINFO embedded in the control section, and uses it to build the package again from locked inputs.

The intention is that we would be able to tell whether package builds are reproducible when built with all the same config and versions of the tools that were originally used, and if they're not reproducible, how.

Initial tests are promising!

To rebuild our crane package:

$ go run ./ rebuild <(curl -sL https://apk.cgr.dev/chainguard/x86_64/crane-0.20.3-r2.apk)

Its crane binary has the same digest as the original package:

$ tar -Oxf x86_64/crane-0.20.3-r2.apk usr/bin/crane | sha256sum -                        
eaa2d9818a1889daf9fb8fba44e5dba3082a9d22e204e1ff34369fa5491416a4  -
$ curl -sL https://apk.cgr.dev/chainguard/x86_64/crane-0.20.3-r2.apk | tar -Ox usr/bin/crane | sha256sum -
eaa2d9818a1889daf9fb8fba44e5dba3082a9d22e204e1ff34369fa5491416a4  -

🎉

There are however some differences in the surrounding package metadata, which is either a TODO for rebuild or for how we embed stuff into .melange.yaml

$ diff \
  <(tar -Oxf x86_64/crane-0.20.3-r2.apk .melange.yaml) \
  <(curl -sL https://apk.cgr.dev/chainguard/x86_64/crane-0.20.3-r2.apk | tar -Ox .melange.yaml)

• accounts block is moved around inexplicably
• crane is added twice to the test package dependencies

File contents are also slightly different:

$ diff \
  <(tar -tvf x86_64/crane-0.20.3-r2.apk | sort) \
  <(curl -sL https://apk.cgr.dev/chainguard/x86_64/crane-0.20.3-r2.apk | tar -tv | sort)              
1d0
< -rw-r--r--  0 jason  dialout     3054 Feb  8 15:03 var/lib/db/sbom/crane-0.20.3-r2.spdx.json
3,10c2,10
< -rw-r--r--  0 root   root    12409 Feb  8 15:03 .melange.yaml
< -rwxr-xr-x  0 jason  dialout 11870488 Feb  8 15:03 usr/bin/crane
---
> -rw-r--r--  0 root   root     2936 Feb  8 15:03 var/lib/db/sbom/crane-0.20.3-r2.spdx.json
> -rw-r--r--  0 root   root    11827 Feb  8 15:03 .melange.yaml
> -rwxr-xr-x  0 root   root 11870488 Feb  8 15:03 usr/bin/crane

• owner dialout probably because of docker runner vs bwrap
• SBOM is different, probably due to missing metadata

To enable this, it's only a warning to include uses and with with a pipeline, since that's how we resolve the .melange.yaml.