Dear Maintainer, It does not seem to be possible to create a reproducible zip archive with the zip utility. Even when using --no-extra / -X the ordering of the files is not ensured, and the timestamp of the files is not fixed. I tried, for example, to use find <dir> -name '*' -print0 | sort -z | xargs -0 zip -X test.zip to ensure consistent ordering between files, but found no way to ensure that the timestamps in the zip archive are fixed. The environment variable SOURCE_DATE_EPOCH seem to get ignored. I would have expected that --no-extra / -X would cover it, would it be possible to extend it? Would it also be possible to respect SOURCE_DATE_EPOCH?
Zip and unzip don't support SOURCE_DATE_EPOCH at present. Specifying the --no-extra / -X option will remove most of the timestamp fields, but not all of them. Every zip file includes a mandatory DOS last modified date/time field. See section 4.3.7 and 4.3.11 where it mentions the "last mod file time" and "last mod file date" in https://pkwaredownloads.blob.core.windows.net/pem/APPNOTE.txt To get SOURCE_DATE_EPOCH support the "last mod file time" and "last mod file date" fields would need to be changed to use the SOURCE_DATE_EPOCH. If that was done, it would be worth adding similar support to the other extra fields that store file creation/modification/access date/times. Then the reproducible build would no need to specify -no-extra.
As there was a bit of activity with the duplicate issue for this getting created at https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1148886 I thought I'd update this ticket with references to some prior art at SUSE that covers some/all of what this ticket is requesting The first two concern the runtime behaviour of zip and how it stores entries in the zip archive. First is https://build.opensuse.org/projects/Archiving/packages/zip/files/reproducible.patch which looks like it will zap the timestamps in the zip file with the value from SOURCE_DATE_EPOCH , when present. Second is https://build.opensuse.org/projects/Archiving/packages/zip/files/0002-unix-reproducible-directory-order-scandir.patch which gets zip to use scandir() rather than readdir() when walking directories. This ensures that a recursive zip will store a sorted list of files at the cost of having to store a complete directory in memory for sorting The third patch, https://build.opensuse.org/projects/Archiving/packages/zip/files/zip-notimestamp.patch?expand=1, is for zip itself and disables how it displays the build time for the executable in the !zip -v! Output. Debian already has an equivalent change -- https://sources.debian.org/patches/zip/3.0-13/10-remove-build-date.patch/?pow_referer= Note that I've not tested any of these patches — I'm just recording their existence