Dear Maintainer,

It does not seem to be possible to create a reproducible zip archive
with the zip utility.


Even when using --no-extra / -X the ordering of the files is not
ensured, and the timestamp of the files is not fixed.


I tried, for example, to use

find <dir> -name '*' -print0 | sort -z | xargs -0 zip -X test.zip

to ensure consistent ordering between files, but found no way to ensure
that the timestamps in the zip archive are fixed.

The environment variable SOURCE_DATE_EPOCH seem to get ignored.

I would have expected that --no-extra / -X would cover it, would it be
possible to extend it?

Would it also be possible to respect SOURCE_DATE_EPOCH?

Zip  and unzip don't support SOURCE_DATE_EPOCH at present.

Specifying the --no-extra / -X  option will remove most of the timestamp fields, but not all of them.

Every zip file includes a mandatory DOS last modified date/time field. See section  4.3.7 and  4.3.11 where it mentions the "last mod file time"  and "last mod file date" in https://pkwaredownloads.blob.core.windows.net/pem/APPNOTE.txt

To get SOURCE_DATE_EPOCH support the "last mod file time"  and "last mod file date" fields would need to be changed to use the SOURCE_DATE_EPOCH. If that was done, it would be worth adding similar support to the other extra fields that store file creation/modification/access date/times. Then the reproducible build would no need to specify -no-extra.