From 537eaf0db749f749549f2d36434babb936445436 Mon Sep 17 00:00:00 2001
From: Johnathan Corgan <johnathan@corganlabs.com>
Date: Sun, 22 Mar 2026 20:26:00 +0000
Subject: [PATCH] Fix tarball reproducibility: default SOURCE_DATE_EPOCH and
 sort entries

build-tarball.sh only applied --mtime when SOURCE_DATE_EPOCH was
explicitly set, and did not sort tar entries. This produced different
tarballs across builds due to varying timestamps and filesystem
ordering. Default SOURCE_DATE_EPOCH to the git commit timestamp and
add --sort=name for deterministic output.
---
 packaging/systemd/build-tarball.sh | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/packaging/systemd/build-tarball.sh b/packaging/systemd/build-tarball.sh
index b9dfeaa..d6c0e61 100755
--- a/packaging/systemd/build-tarball.sh
+++ b/packaging/systemd/build-tarball.sh
@@ -45,12 +45,16 @@ cp "${SCRIPT_DIR}/README.install.md" "${STAGING_DIR}/"
 
 chmod +x "${STAGING_DIR}/install.sh" "${STAGING_DIR}/uninstall.sh"
 
-# Create tarball (reproducible: normalize timestamps and ownership)
+# Create tarball (reproducible: normalize timestamps, ownership, and sort order)
 cd "${DEPLOY_DIR}"
-TAR_REPRO_FLAGS=""
-if [ -n "${SOURCE_DATE_EPOCH:-}" ]; then
-    TAR_REPRO_FLAGS="--mtime=@${SOURCE_DATE_EPOCH}"
+
+# Default SOURCE_DATE_EPOCH to git commit timestamp if not set
+if [ -z "${SOURCE_DATE_EPOCH:-}" ]; then
+    SOURCE_DATE_EPOCH=$(git -C "${PROJECT_ROOT}" log -1 --format=%ct)
+    export SOURCE_DATE_EPOCH
 fi
+
+TAR_REPRO_FLAGS="--mtime=@${SOURCE_DATE_EPOCH} --sort=name"
 if tar --version 2>/dev/null | grep -q 'GNU tar'; then
     TAR_REPRO_FLAGS="${TAR_REPRO_FLAGS} --numeric-owner --owner=0 --group=0"
 fi