dist: verify tarball reproducibility in CI

Closes #13327

diff --git a/.github/workflows/distcheck.yml b/.github/workflows/distcheck.yml
index 1a644ef7d11b0b46b165a32608ceda8872701bc0..c09927e7cef4264c2516242880c48849ece1e30f 100644 (file)
--- a/.github/workflows/distcheck.yml
+++ b/.github/workflows/distcheck.yml
@@ -38,8 +38,17 @@ jobs:
       - run: make V=1 && make V=1 clean
         name: 'make and clean'
 
-      - run: ./maketgz 99.98.97
-        name: 'maketgz'
+      - name: 'maketgz'
+        run: |
+          SOURCE_DATE_EPOCH=1711526400 ./maketgz 99.98.97
+
+      - name: 'maketgz reproducibility test'
+        run: |
+          mkdir run1; mv ./curl-99.98.97.* run1/
+          make V=1 && make V=1 clean
+          SOURCE_DATE_EPOCH=1711526400 ./maketgz 99.98.97
+          mkdir run2; cp -p ./curl-99.98.97.* run2/
+          diff run1 run2
 
       - uses: actions/upload-artifact@v4
         with: