gnutar: Make reproducible by default

tidepool/src/packages/foundation/gnutar/versions/1.35-stage1-passthrough.nix

@@ -30,6 +30,8 @@ in
       license = lib.licenses.gpl3Plus;
     };
 
+    hooks = package.hooks;
+
     platforms = {
       build = "@linux";
       host = "@linux";

tidepool/src/packages/foundation/gnutar/versions/1.35-stage1.nix

@@ -82,6 +82,32 @@ in
           gcc-cross = packages.foundation.gcc.versions."13.2.0-stage2".target.${config.platform.host};
           binutils-cross = packages.foundation.binutils.versions."2.41-stage1".target.${config.platform.host};
         };
+
+      host.bash = packages.foundation.bash.latest;
+    };
+
+    hooks = _: {
+      # This makes tar reproducible by default within derivations,
+      # but does not change the semantics of tar when used outside of
+      # derivations
+      #
+      # We want to ensure we prepend to PATH so our wrapper is picked first.
+      # TODO?: Possible use SOURCE_DATE_EPOCH
+      # https://reproducible-builds.org/specs/source-date-epoch/
+      # https://reproducible-builds.org/docs/source-date-epoch/
+      "aux:wrap:tar" = lib.dag.entry.before [ "unpack" ] ''
+        tar_wrap_dir=$(mktemp -d)
+        tar_out=${config.package}
+
+        cat << EOF > "$tar_wrap_dir/tar"
+        #!${config.deps.host.bash}/bin/bash
+        TAR_OPTIONS="--mtime=@1 --owner=0 --group=0 --numeric-owner --sort=name" "$tar_out/bin/tar" "\$@"
+        EOF
+
+        chmod +x "$tar_wrap_dir/tar"
+
+        export PATH="$tar_wrap_dir":"$PATH"
+      '';
     };
 
     phases = {