Reproducible builds for Git for Windows

[PtJade-Ceramic]

Reproducible builds for Git for Windows

Summary

I would like to propose making Git for Windows artifacts reproducible: given the same source tag and SDK snapshot, rebuilding should produce byte-identical binaries and archives. This lets anyone independently verify that an official release was built from the published sources.

The MSYS2 project already treats SOURCE_DATE_EPOCH as the reproducibility convention for the toolchain (see msys2-tests toolchain/custom/test-reproducible), so this is a natural fit for Git for Windows, which builds on the same MSYS2/MinGW toolchain.

What I have verified

On GitHub Actions, with SOURCE_DATE_EPOCH fixed to the source-tag commit time, I verified that:

• Compile determinism: building the mingw-w64-git package twice yields byte-identical results, after handling:
  • GIT-VERSION-GEN version drift when building outside a release tag (pin via the version file mechanism)
  • the git.manifest CRLF vs LF line endings
  • the CodeView PDB GUID that the linker/cv2pdb stamps into the .debug section (drop it at the end of build())
• Packaging determinism: the portable, MinGit and tar archives are byte-identical across two runs (release-script mtime pinning + -mta- -mtc-).
• The installer is reproducible except for the gzip header mtime that Inno Setup embeds at compile time. Inno Setup does not yet honor SOURCE_DATE_EPOCH; that is a separate upstream change (jrsoftware/issrc).

Proposed changes / PRs

1. build-extra -- honor SOURCE_DATE_EPOCH in the release scripts (installer, portable, mingit, archive). PR: release scripts: support reproducible builds via SOURCE_DATE_EPOCH build-extra#730
2. MINGW-packages / mingw-w64-git -- compile-time determinism (GIT-VERSION-GEN version pin, manifest LF, drop CodeView GUID). (preparing)
3. git-for-windows-automation -- set SOURCE_DATE_EPOCH in the artifact workflow so CI produces reproducible artifacts. (preparing)
4. jrsoftware/issrc (separate upstream) -- feature request for Inno Setup to honor SOURCE_DATE_EPOCH for the embedded gzip header mtime. (preparing)

Questions for the maintainers

• Is reproducible-build support something Git for Windows would like to adopt?
• Any preferences on where the SOURCE_DATE_EPOCH value should be pinned (e.g. the source-tag commit time vs a fixed value)?
• Should the CI workflow set SOURCE_DATE_EPOCH by default, or keep it opt-in for now?

I'm happy to split, adjust, or rebase the PRs based on feedback.