As there was a bit of activity with the duplicate issue for this getting created at https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1148886 I thought I'd update this ticket with references to some prior art at SUSE that covers some/all of what this ticket is requesting
The first two concern the runtime behaviour of zip and how it stores entries in the zip archive. First is https://build.opensuse.org/projects/Archiving/packages/zip/files/reproducible.patch which looks like it will zap the timestamps in the zip file with the value from SOURCE_DATE_EPOCH , when present. Second is https://build.opensuse.org/projects/Archiving/packages/zip/files/0002-unix-reproducible-directory-order-scandir.patch which gets zip to use scandir() rather than readdir() when walking directories. This ensures that a recursive zip will store a sorted list of files at the cost of having to store a complete directory in memory for sorting The third patch, https://build.opensuse.org/projects/Archiving/packages/zip/files/zip-notimestamp.patch?expand=1, is for zip itself and disables how it displays the build time for the executable in the !zip -v! Output. Debian already has an equivalent change -- https://sources.debian.org/patches/zip/3.0-13/10-remove-build-date.patch/?pow_referer= Note that I've not tested any of these patches — I'm just recording their existence
