Make release archives reproducible

[fingolfin]

I had to re-release anupq due to resolve gap-actions/update-gh-pages#12 -- annoyingly this changed the tarball checksums.

It would be nice if we could avoid this, or at least minimize the chance for it happening.

Right now,

• the PDF may change -- can be solved by setting the SOURCE_DATE_EPOCH environment variable suitable
• the tarball can have variance, e.g. due to different a/c/mtimes on files, ownership etc.
• one has to be careful with gzip etc. (I think we are fine due to using -c, but it might be necessary to also specify -n, --no-name ?)
• possibly more, to be tested.

For timestamps and SOURCE_DATE_EPOCH one could extract the timestamp from the commit from which the release is made.

Hints to deal with those can be found on https://reproducible-builds.org.

[stertooy]

The SOURCE_DATE_EPOCH thing already happens in build-pkg-docs (here). Should that variable also be set somewhere else (or globally?), or set so something else?

While I think reproducible archives would be a great addition, as a solution to "the update-gh-pages action previously failed" it seems a bit overkill? If the archives created by release-pkg were fine, we shouldn't have to recreate them. Instead, having a separate workflow to update the GitHub Pages (which optionally could be called by the Release workflow), or creating a new input like "only-update-pages" for the Release workflow, seem more straightforward?

[fingolfin]

I agree that "just update the website" would be a better solution in this case, but was not readily available (and still isn't for most packages without adding or modifying a workflow in ~150 repos - though if we have it for one I should be aple to push it to all with reasonable effort).

Alas, this is simply how came to (once again) realize this problem.