Zip files record mtimes of packed files. When files are generated during the build, it will prevent reproducibility.

[[https://reproducible.debian.net/issues/timestamps_in_zip_issue.html|Known affected packages]]

= Detection =

[[attachment:boa-constructor_0.6.1-13.debbindiff.html|Example debbindiff output]]

= Work-around =

DebianPts:strip-nondeterminism will normalize Zip files.

= Solution =

Use `find`, `xargs`, and `touch` to adjust file mtimes before `zip` is run. Example:

{{{
BUILD_DATE := $(shell dpkg-parsechangelog --show-field=Date)
[…]
       find '$(DIR)' -newermt '$(BUILD_DATE)' -print0 | \
               xargs -0r touch --no-dereference --date='$(BUILD_DATE)'
       […] zip […]
}}}

You may also need to use `zip -o`/`zip --latest-time` to set the last-modification timestamp of the zip file itself to its most recently modified member, use `zip -X`/`zip --no-extra` to omit extended timestamps from the zip file, and/or `export TZ=UTC` to force zip to use UTC for the local-time MS-DOS timestamps in the zip file.

Note that the -S (or --show-field) option is not working well with Ubuntu 14.04 (aka Trusty). So if you plan a backport of your package for this distribution, you can instead of the -S option, use this to extract the date field:

{{{
dpkg-parsechangelog | grep Date: | cut -d' ' -f2
}}}