Add `--reproducible` flag to `flux push artifact`

This makes the pushed artifact have the exact same hash if the contents
are the same.

E.g
```
flux push artifact oci://repo/image:tag1 --source deploy --revision="test" --path=deploy --reproducible
flux push artifact oci://repo/image:tag2 --source deploy --revision="test" --path=deploy --reproducible
```

will both result in the same sha hash, tagged with `tag1` and `tag2`.

This is useful when producing flux artifacts in a monorepo setup where
you don't want to unnecessarily push new artifacts unless something has
actually changed.

Signed-off-by: frekw <fredrik@warnsberg.se>

cmd/flux/push_artifact.go

@@ -114,6 +114,7 @@ type pushArtifactFlags struct {
 	annotations  []string
 	output       string
 	debug        bool
+	reproducible bool
 }
 
 var pushArtifactArgs = newPushArtifactFlags()
@@ -135,6 +136,7 @@ func init() {
 	pushArtifactCmd.Flags().StringVarP(&pushArtifactArgs.output, "output", "o", "",
 		"the format in which the artifact digest should be printed, can be 'json' or 'yaml'")
 	pushArtifactCmd.Flags().BoolVarP(&pushArtifactArgs.debug, "debug", "", false, "display logs from underlying library")
+	pushArtifactCmd.Flags().BoolVar(&pushArtifactArgs.reproducible, "reproducible", false, "ensure reproducible image digests by setting the created timestamp to '1970-01-01T00:00:00Z'")
 
 	pushCmd.AddCommand(pushArtifactCmd)
 }
@@ -202,6 +204,11 @@ func pushArtifactCmdRun(cmd *cobra.Command, args []string) error {
 		Annotations: annotations,
 	}
 
+	if pushArtifactArgs.reproducible {
+		zeroTime := time.Unix(0, 0)
+		meta.Created = zeroTime.Format(time.RFC3339)
+	}
+
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()