gnutar: Make bootstrap bash reproducible by default

tidepool/src/packages/foundation/gnutar/versions/1.35-bootstrap.nix

@@ -1,4 +1,4 @@
-{ global }:
+{ global, config }:
 
 let
   inherit (global) lib builders;
@@ -14,10 +14,31 @@ in
 
     platforms.build = "i686-linux";
 
+    deps.host.bash = global.packages.foundation.bash.versions."5.2.15-bootstrap";
+
+    hooks = _: {
+      # This makes tar reproducible by default within derivations,
+      # but does not change the semantics of tar when used outside of
+      # derivations
+      #
+      # We want to ensure we prepend to PATH so our wrapper is picked first.
+      "aux:wrap:tar" = lib.dag.entry.before [ "unpack" ] ''
+        tar_wrap_dir=$(mktemp -d)
+        tar_out=${config.package}
+
+        cat << EOF > "$tar_wrap_dir/tar"
+        #!${config.deps.host.bash}/bin/bash
+        TAR_OPTIONS="--mtime=@1 --owner=0 --group=0 --numeric-owner --sort=name" "$tar_out/bin/tar" "\$@"
+        EOF
+
+        chmod +x "$tar_wrap_dir/tar"
+
+        export PATH="$tar_wrap_dir":"$PATH"
+      '';
+    };
+
     builder = builders.foundation.passthrough.extend {
-      settings = {
-        derivation = foundation.stage2-gnutar;
-      };
+      settings.derivation = foundation.stage2-gnutar;
     };
   };
 }