Fixed tar timestamping issue.

The tar command always stores last modified timestamps. Because we are
streaming the data to tar via stdin, this data is not given to tar, so
timestamp is set to the time the package is built. This causes the
package checksums to *always* differ, which is horrible for reproducible
builds.

Since we don't really care that much about source system timestamps
since the installer becomes the source of truth, we now set last
modified timestamp to 1970-01-01. This ensures that a package built at
different times but with no modifications will yield the same checksum.

1 files changed, 2 insertions, 2 deletions

diff --git a/pkgself.sh b/pkgself.sh
index eea1718..c47a713 100755
--- a/pkgself.sh
+++ b/pkgself.sh
@@ -131,7 +131,7 @@ main() {
   printf "Reticulating splines...\n"
 
   # Package up the libinstall libraries
-  tar -C "${tmp}" -c libinstall \
+  tar -C "${tmp}" -c --mtime='1970-01-01' libinstall \
     | ${COMPRESS} > ${tmp}/libinstall.tar.${COMPRESSEXT}
   libinstallsize=$(wc -c < ${tmp}/libinstall.tar.${COMPRESSEXT})
 
@@ -140,7 +140,7 @@ main() {
   runsize="$(wc -c < ${tmp}/run.sh.${COMPRESSEXT})"
 
   # Compress and calculate byte size for payload
-  tar -c "$(basename ${PKG})" \
+  tar -c --mtime='1970-01-01' "$(basename ${PKG})" \
     | ${COMPRESS} -v > ${PKG}.tar.${COMPRESSEXT}
   payloadsize="$(wc -c < ${PKG}.tar.${COMPRESSEXT})"