When gear executes a command and passes it a pkg.tar generated from a tag object, it should pass to this command a SOURCE_DATE_EPOCH environment variable initialized from the tag object: if the tag object is signed, SOURCE_DATE_EPOCH should be defined to the signature time, otherwise to the time saved in tagger entry.
Alternatively, when given a tag object, gear can ignore the signature time and always use the time saved in tagger entry, assuming that in signed tags the time saved in tagger entry is also signed. In addition, when given a commit object, gear can use the time saved in committer entry.
I'm going to implement the following change: When gear extracts from a tag object, it would set $SOURCE_DATE_EPOCH to the tagger timestamp before invoking an external command. Likewise, when gear extracts from a commit object, it would set $SOURCE_DATE_EPOCH to the committer timestamp before invoking an external command. When $SOURCE_DATE_EPOCH is set, gear-command-tar would specify tar --mtime option, thus setting mtime of files in the pkg.tar to $SOURCE_DATE_EPOCH.
gear-2.1.1-alt1 -> sisyphus: Mon Nov 20 2017 Dmitry V. Levin <ldv@altlinux> 2.1.1-alt1 - Applied bash4 compatibility workaround (closes: #32147). - Added SOURCE_DATE_EPOCH support (closes: #34203).
