Package: src:php8.4 Severity: normal The patch added for #1034892 sets the timestamp of every entry to 0 in phar_flush(), not only when phar.phar is built during the package build, so every phar created with the Phar API on Debian gets timestamps of 0.
OPcache takes a timestamp of 0 as "no timestamp available" and doesn't cache the script (persistent_compile_file() in ext/opcache/ZendAccelerator.c), unless opcache.validate_timestamps, opcache.file_update_protection and opcache.max_file_size are all disabled. Scripts included from such phars are then compiled again on every include, and filemtime() on their entries returns 0. Using SOURCE_DATE_EPOCH when it is set (dpkg-buildpackage exports it) and time(NULL) otherwise would keep phar.phar reproducible without changing the phars users build. php8.5 carries the same patch: the deb.sury.org build of 8.5.10 also writes timestamps of 0. Upstream discussion: https://github.com/php/php-src/issues/19997#issuecomment-5832183937
