Set the time of the HEAD commit as the OCI created field

Apparently it uses `date -Iseconds` to parse, so we can use @ with a timestamp

Also it doesn't parse `created` in buildImage, only buildLayeredImage

Signed-off-by: morguldir <morguldir@protonmail.com>

flake.nix

@@ -194,10 +194,12 @@
       };
 
       mkOciImage = pkgs: package: allocator:
-        pkgs.dockerTools.buildImage {
+        pkgs.dockerTools.buildLayeredImage {
           name = package.pname;
           tag = "main";
-          copyToRoot = [
+          # Debian makes builds reproducible through using the HEAD commit's date
+          created = "@${toString self.lastModified}";
+          contents = [
             pkgs.dockerTools.caCertificates
           ];
           config = {