Merge pull request #236976 from amarshall/zip-reproducible

pkgs/applications/blockchains/bisq-desktop/default.nix

@@ -9,6 +9,7 @@
 , dpkg
 , writeScript
 , bash
+, strip-nondeterminism
 , tor
 , zip
 , xz
@@ -41,7 +42,15 @@ stdenv.mkDerivation rec {
     sha256 = "0jisxzajsc4wfvxabvfzd0x9y1fxzg39fkhap1781q7wyi4ry9kd";
   };
 
-  nativeBuildInputs = [ makeWrapper copyDesktopItems imagemagick dpkg zip xz ];
+  nativeBuildInputs = [
+    copyDesktopItems
+    dpkg
+    imagemagick
+    makeWrapper
+    strip-nondeterminism
+    xz
+    zip
+  ];
 
   desktopItems = [
     (makeDesktopItem {
@@ -64,8 +73,9 @@ stdenv.mkDerivation rec {
 
     mkdir -p native/linux/x64/
     cp ${bisq-tor} ./tor
-    tar -cJf native/linux/x64/tor.tar.xz tor
+    tar --sort=name --mtime="@$SOURCE_DATE_EPOCH" -cJf native/linux/x64/tor.tar.xz tor
     zip -r opt/bisq/lib/app/desktop-${version}-all.jar native
+    strip-nondeterminism opt/bisq/lib/app/desktop-${version}-all.jar
   '';
 
   installPhase = ''

pkgs/applications/emulators/pcsx2/default.nix

@@ -23,6 +23,7 @@
 , rapidyaml
 , SDL2
 , soundtouch
+, strip-nondeterminism
 , vulkan-headers
 , vulkan-loader
 , wayland
@@ -58,7 +59,13 @@ stdenv.mkDerivation rec {
     "-DDISABLE_BUILD_DATE=TRUE"
   ];
 
-  nativeBuildInputs = [ cmake pkg-config wrapQtAppsHook zip ];
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    strip-nondeterminism
+    wrapQtAppsHook
+    zip
+  ];
 
   buildInputs = [
     curl
@@ -95,6 +102,7 @@ stdenv.mkDerivation rec {
     install -Dm644 $src/.github/workflows/scripts/linux/pcsx2-qt.desktop $out/share/applications/PCSX2.desktop
 
     zip -jq $out/bin/resources/patches.zip ${pcsx2_patches}/patches/*
+    strip-nondeterminism $out/bin/resources/patches.zip
   '';
 
   qtWrapperArgs = [

pkgs/build-support/fetchfirefoxaddon/default.nix

@@ -1,7 +1,13 @@
-{stdenv, unzip, jq, zip, fetchurl,writeScript,  ...}:
+{ stdenv
+, fetchurl
+, jq
+, strip-nondeterminism
+, unzip
+, writeScript
+, zip
+}:
 
-{
-  name
+{ name
 , url ? null
 , md5 ? ""
 , sha1 ? ""
@@ -14,7 +20,8 @@
 
 let
   extid = if fixedExtid == null then "nixos@${name}" else fixedExtid;
-  source = if url == null then src else fetchurl {
+  source = if url == null then src else
+  fetchurl {
     url = url;
     inherit md5 sha1 sha256 sha512 hash;
   };
@@ -38,7 +45,14 @@ stdenv.mkDerivation {
     echo "$NEW_MANIFEST" > "$out/$UUID/manifest.json"
     cd "$out/$UUID"
     zip -r -q -FS "$out/$UUID.xpi" *
+    strip-nondeterminism "$out/$UUID.xpi"
     rm -r "$out/$UUID"
   '';
-  nativeBuildInputs = [ unzip zip jq  ];
+
+  nativeBuildInputs = [
+    jq
+    strip-nondeterminism
+    unzip
+    zip
+  ];
 }

pkgs/development/tools/slimerjs/default.nix

@@ -1,4 +1,12 @@
-{ lib, stdenv, fetchFromGitHub, zip, unzip, firefox, bash }:
+{ lib
+, bash
+, fetchFromGitHub
+, firefox
+, strip-nondeterminism
+, stdenv
+, unzip
+, zip
+}:
 
 stdenv.mkDerivation rec {
   pname = "slimerjs";
@@ -12,7 +20,10 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [ zip ];
-  nativeBuildInputs = [ unzip ];
+  nativeBuildInputs = [
+    strip-nondeterminism
+    unzip
+  ];
 
   preConfigure = ''
     test -d src && cd src
@@ -20,6 +31,7 @@ stdenv.mkDerivation rec {
   '';
 
   installPhase = ''
+    strip-nondeterminism --type zip omni.ja
     mkdir -p "$out"/{bin,share/doc/slimerjs,lib/slimerjs}
     cp LICENSE README* "$out/share/doc/slimerjs"
     cp -r * "$out/lib/slimerjs"

pkgs/games/mari0/default.nix

@@ -1,5 +1,13 @@
-{ lib, stdenv, fetchFromGitHub, zip, love, makeWrapper, makeDesktopItem
-, copyDesktopItems }:
+{ lib
+, copyDesktopItems
+, fetchFromGitHub
+, love
+, makeDesktopItem
+, makeWrapper
+, stdenv
+, strip-nondeterminism
+, zip
+}:
 
 stdenv.mkDerivation rec {
   pname = "mari0";
@@ -12,7 +20,12 @@ stdenv.mkDerivation rec {
     sha256 = "1zqaq4w599scsjvy1rsb21fd2r8j3srx9vym4ir9bh666dp36gxa";
   };
 
-  nativeBuildInputs = [ makeWrapper copyDesktopItems zip ];
+  nativeBuildInputs = [
+    copyDesktopItems
+    makeWrapper
+    strip-nondeterminism
+    zip
+  ];
 
   desktopItems = [
     (makeDesktopItem {
@@ -28,6 +41,7 @@ stdenv.mkDerivation rec {
   installPhase = ''
     runHook preInstall
     zip -9 -r mari0.love ./*
+    strip-nondeterminism --type zip mari0.love
     install -Dm444 -t $out/share/games/lovegames/ mari0.love
     makeWrapper ${love}/bin/love $out/bin/mari0 \
       --add-flags $out/share/games/lovegames/mari0.love

pkgs/games/orthorobot/default.nix

@@ -1,5 +1,15 @@
-{ lib, stdenv, fetchurl, fetchFromGitHub, love, zip, fetchpatch, makeWrapper
-, makeDesktopItem, copyDesktopItems }:
+{ lib
+, copyDesktopItems
+, fetchFromGitHub
+, fetchpatch
+, fetchurl
+, love
+, makeDesktopItem
+, makeWrapper
+, stdenv
+, strip-nondeterminism
+, zip
+}:
 
 stdenv.mkDerivation rec {
   pname = "orthorobot";
@@ -29,7 +39,12 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  nativeBuildInputs = [ makeWrapper zip copyDesktopItems ];
+  nativeBuildInputs = [
+    copyDesktopItems
+    makeWrapper
+    strip-nondeterminism
+    zip
+  ];
 
   patches = [
     # support for love11
@@ -42,6 +57,7 @@ stdenv.mkDerivation rec {
   installPhase = ''
     runHook preInstall
     zip -9 -r orthorobot.love ./*
+    strip-nondeterminism --type zip orthorobot.love
     install -Dm444 -t $out/share/games/lovegames/ orthorobot.love
     makeWrapper ${love}/bin/love $out/bin/orthorobot \
                 --add-flags $out/share/games/lovegames/orthorobot.love

pkgs/games/wireworld/default.nix

@@ -6,6 +6,7 @@
 , makeWrapper
 , makeDesktopItem
 , copyDesktopItems
+, strip-nondeterminism
 }:
 
 stdenv.mkDerivation rec {
@@ -19,7 +20,12 @@ stdenv.mkDerivation rec {
     hash = "sha256-8BshnGLuA8lmG9g7FU349DWKP/fZvlvjrQBau/LSJ4E=";
   };
 
-  nativeBuildInputs = [ makeWrapper copyDesktopItems zip ];
+  nativeBuildInputs = [
+    copyDesktopItems
+    makeWrapper
+    strip-nondeterminism
+    zip
+  ];
 
   desktopItems = [
     (makeDesktopItem {
@@ -35,6 +41,7 @@ stdenv.mkDerivation rec {
   installPhase = ''
     runHook preInstall
     zip -9 -r Wireworld.love ./*
+    strip-nondeterminism --type zip Wireworld.love
     install -Dm444 -t $out/share/games/lovegames/ Wireworld.love
     makeWrapper ${love}/bin/love $out/bin/Wireworld \
       --add-flags $out/share/games/lovegames/Wireworld.love

pkgs/tools/misc/pridefetch/default.nix

@@ -1,4 +1,12 @@
-{ lib, stdenv, fetchFromGitHub, python3, zip }: let
+{ lib
+, fetchFromGitHub
+, python3
+, stdenv
+, strip-nondeterminism
+, zip
+}:
+
+let
   version = "1.1.0";
   sha256 = "sha256-563xOz63vto19yuaHtReV1dSw6BgNf+CLtS3lrPnaoc=";
 
@@ -9,25 +17,33 @@
     rev = "v" + version;
     inherit sha256;
   };
-in stdenv.mkDerivation {
+in
+
+stdenv.mkDerivation {
   inherit pname version src;
+
   nativeBuildInputs = [
+    strip-nondeterminism
     zip
   ];
+
   buildInputs = [
     (python3.withPackages (pythonPackages: with pythonPackages; [
       distro
     ]))
   ];
+
   buildPhase = ''
     runHook preBuild
     pushd src
     zip -r ../pridefetch.zip ./*
+    strip-nondeterminism ../pridefetch.zip
     popd
     echo '#!/usr/bin/env python' | cat - pridefetch.zip > pridefetch
     rm pridefetch.zip
     runHook postBuild
   '';
+
   installPhase = ''
     runHook preInstall
     mkdir -p $out/bin
@@ -35,6 +51,7 @@ in stdenv.mkDerivation {
     chmod +x $out/bin/pridefetch
     runHook postInstall
   '';
+
   meta = with lib; {
     description = "Print out system statistics with pride flags";
     longDescription = ''