From 551bbc60de02bb8304087b368b8c6f567fa887b7 Mon Sep 17 00:00:00 2001
From: Ross Smyth <snix@treefroog.com>
Date: Sat, 25 Oct 2025 12:18:32 -0400
Subject: [PATCH] gnutar: Make bootstrap bash reproducible by default

---
 .../gnutar/versions/1.35-bootstrap.nix        | 29 ++++++++++++++++---
 1 file changed, 25 insertions(+), 4 deletions(-)

diff --git a/tidepool/src/packages/foundation/gnutar/versions/1.35-bootstrap.nix b/tidepool/src/packages/foundation/gnutar/versions/1.35-bootstrap.nix
index 15d5da9..55dfcf3 100644
--- a/tidepool/src/packages/foundation/gnutar/versions/1.35-bootstrap.nix
+++ b/tidepool/src/packages/foundation/gnutar/versions/1.35-bootstrap.nix
@@ -1,4 +1,4 @@
-{ global }:
+{ global, config }:
 
 let
   inherit (global) lib builders;
@@ -14,10 +14,31 @@ in
 
     platforms.build = "i686-linux";
 
+    deps.host.bash = global.packages.foundation.bash.versions."5.2.15-bootstrap";
+
+    hooks = _: {
+      # This makes tar reproducible by default within derivations,
+      # but does not change the semantics of tar when used outside of
+      # derivations
+      #
+      # We want to ensure we prepend to PATH so our wrapper is picked first.
+      "aux:wrap:tar" = lib.dag.entry.before [ "unpack" ] ''
+        tar_wrap_dir=$(mktemp -d)
+        tar_out=${config.package}
+
+        cat << EOF > "$tar_wrap_dir/tar"
+        #!${config.deps.host.bash}/bin/bash
+        TAR_OPTIONS="--mtime=@1 --owner=0 --group=0 --numeric-owner --sort=name" "$tar_out/bin/tar" "\$@"
+        EOF
+
+        chmod +x "$tar_wrap_dir/tar"
+
+        export PATH="$tar_wrap_dir":"$PATH"
+      '';
+    };
+
     builder = builders.foundation.passthrough.extend {
-      settings = {
-        derivation = foundation.stage2-gnutar;
-      };
+      settings.derivation = foundation.stage2-gnutar;
     };
   };
 }