phar: honor SOURCE_DATE_EPOCH for timestamps

[arjendekorte]

In order to build reproducible phars, honor SOURCE_DATE_EPOCH
if set

Signed-off-by: Arjen de Korte build+github@de-korte.org

[nikic]

@cmb69 Does the general idea here seem reasonable?

[cmb69]

At least partially, this looks like a workaround for https://bugs.php.net/77229 and related issues. The problem is that the timestamp of phar entries should be the mtime of the file, but we're using the current time which is wrong anyway.

[arjendekorte]

At least partially, this looks like a workaround for https://bugs.php.net/77229 and related issues. The problem is that the timestamp of phar entries should be the mtime of the file, but we're using the current time which is wrong anyway.

Using the mtime of the files would probably also fix the reproducible build. The thing that slightly worries me, is that the existing (wrong) timestamps have been used for as long as I can trace back and fixing this might break applications that rely on this. The change to just honor SOURCE_DATE_EPOCH would limit the exposure, as this usually is only set during packaging PHP where this is an intentional change and doesn't change the behavior if not set.