Reproducible tar balls (current)

commit 9cf18fe5e8d8a6ec20266c39ac60f36e7a8eb109
Author: Fabian Keil <fk@fabiankeil.de>
Date:   Mon Jun 1 13:56:05 2015 +0200

    release/Makefile: Build the src.txz only once and also fake source ownership
[...]
diff --git a/release/Makefile b/release/Makefile
index 4c2b530..b968a02 100644
--- a/release/Makefile
+++ b/release/Makefile
@@ -150,11 +150,25 @@ kernel.txz:
 src.txz:
[...]
-           ${XZ_CMD} > ${.OBJDIR}/src.txz
+# Create an mtree spec with faked timestamps so we get a reproducible
+# tar file. We do not use tar for this because it's mtree generator
+# appears to be buggy and exits with an memory allocation failure.
+#
+# It's important that the excluded paths start with "./", otherwise
+# file locations are not recorded correctly, and, for example,
+# usr/src/usr.sbin appears as usr/src/release/usr.sbin in the
+# tar file. Only the shadow knows if that's a bug or a feature.
+       echo "./usr/src/.git" >${.OBJDIR}/mtree-exclude
+       echo "./usr/src/release/dist" >>${.OBJDIR}/mtree-exclude
+       echo "./usr/src/release/src.mtree" >>${.OBJDIR}/mtree-exclude
+       echo "./usr/src/release/mtree-exclude" >>${.OBJDIR}/mtree-exclude
+       cd ${DISTDIR} && mtree -c -L -k time -X ${.OBJDIR}/mtree-exclude | \
+           sed -E -e 's@(time=)[0-9]+\.[0-9]+@\1${EPOCH_DATE}.0 uid=0 gid=0@' \
+           > ${.OBJDIR}/src.mtree
+       rm ${.OBJDIR}/mtree-exclude
+       cd ${DISTDIR} && tar cLvf - @${.OBJDIR}/src.mtree \
+           | ${XZ_CMD} > ${.OBJDIR}/src.txz
+       rm ${.OBJDIR}/src.mtree
[...]