Generate Reproducible Release Tarball

Medium Shell Packaging Asked at Nokia

Solve this problem

Package a firmware release so two builds from the same source produce byte-identical archives, which is what makes a release verifiable.

Constraints

Fix mtime, owner, group and permissions inside the archive.
Sort entries so the order does not depend on the filesystem.
Use gzip -n so no timestamp is embedded.
Emit a SHA-256 of the finished tarball.
Exit 1 if the source directory is missing.
GNU tar options are acceptable.

Starter codeShell

1#!/bin/sh2# TODO: build a reproducible tarball