investigate sorce epoch timestamps

[errordeveloper]

Currently, tape picks the most recent modtime from files in manifest dir and uses that to set source epoch.

There is this TODO note:

https://github.com/docker/labs-brown-tape/blob/279e45a0f87718866ac7cc99916efde14f7b44ca/manifest/loader/loader.go#L71-L77

[errordeveloper]

@stefanprodan you also mentioned that you've seen various CI systems not handling modtimes well, I would have thought that this should be down to whatever git writes out on checkout. I've not checked what Git does exactly yet, but I am assuming it picks up the commit timestamp? Were you speaking of some crazy CI hack you've seen?

[stefanprodan]

What I've seen are CI jobs who do modify files due to various reasons (e.g. writing some file in a dir then delete it), that's why I think using the Git metadata and set the created timestamp to the HEAD commit TS is the best way to achieve reproducible builds, this is also the recommendation made by https://reproducible-builds.org