Tags: timestamps tar docker tarball 

Rating:

The challenge was to fix a broken Docker tar archive.

The order of layers in the Docker image must be determined for the `flag.sh` script to print the flag. Multiple files, from different layers, are concatenated together to print the flag. Because some of these files are deleted or replace other files, an incorrect ordering of layers will print the wrong flag.

`manfiest.json`:

```
{
"Layers": [
"2354d65e014cbe530f9695dbe3faf8ac84d85d7ad91f5d46ba8ef3fc0cd88d95\/layer.tar",
"4337e82a87b98a9c74a8328f7059baf04a2ad31081c9893c5f37d4dd85137988\/layer.tar",
"7204dd4cdfd9b6d29a095cf1fd3b2e7efe366f191c31a75df4ea8e9f47a70801\/layer.tar",
"c843887778784dad565b239aa712a3228d9a878f2d3f129f3ab7341a84f11910\/layer.tar",
"????????????????????????????????????????????????????????????????\/layer.tar",
"????????????????????????????????????????????????????????????????\/layer.tar",
"????????????????????????????????????????????????????????????????\/layer.tar",
...
"????????????????????????????????????????????????????????????????\/layer.tar",
"????????????????????????????????????????????????????????????????\/layer.tar",
"????????????????????????????????????????????????????????????????\/layer.tar",
"b94e5d83dbbff95e883f0f53bcf47c017471b13d81325697be6e22cdc8c369aa\/layer.tar",
"24d12bbeb0a9fd321a8decc0c544f84bf1f6fc2fd69fa043602e012e3ee6558b\/layer.tar"
],
...
}
```

A file isn't deleted from a layer unless it was already created by a previous layer, this makes it possible to solve a dependency tree of the layers (this is what most solutions to this challenge did).

However, a much simpler solution is possible: sort the docker tar layers by mtime timestamp. The files created in the docker tar layers have different timestamps, accurate to one second. Except for two pairs of files, all the timestamps are unique. These two pairs can be resolved manually.

1. Find the newest timestamp in each layer
2. Sort layers by their newest timestamp
3. Reconstruct the tarball with this layer order

Solution:
https://gist.github.com/bburky/58edd7ce00cd4405429269695568fe2c

Original writeup (https://gist.github.com/bburky/58edd7ce00cd4405429269695568fe2c).