bug: make release archive timestamps independent of the host timezone #511

Goal

make release archive timestamps independent of the host timezone.

Background and verified evidence

Review date: 2026-09-17. Reviewed commit: 38042cbf23b9380c626aae6c9fe168f97096c1cc. Parent: #214.

Both timestamp normalization loops in scripts/release-artifact use touch -t 198001010000 without a fixed timezone. Fresh Base Bash artifact builds from the same reviewed commit under Asia/Kolkata and UTC produce different archive digests. The first archive entry has mtime 315513000 versus 315532800 (a 19,800-second difference). Existing repeated-build tests use one ambient timezone and miss this source of nondeterminism.

Scope and acceptance criteria

• Normalize timestamps to a fixed UTC epoch independently of the caller environment.
• Compare complete artifact sets built under at least two different timezones, retaining a non-UTC test case.
• Keep locale and supported tar implementation boundaries explicit in reproducibility documentation.

Validation

Build identical versions/commits into separate temporary directories with TZ=UTC and TZ=Asia/Kolkata, compare archive/checksum/SBOM/provenance bytes, then run release artifact tests. Do not replace existing release assets.

Non-goals

No unrelated API expansion or automatic release publication. Preserve immutable published assets and unrelated consumer files.

Project fields

• Status: Ready
• Priority: P2
• Area: Packaging
• Initiative: Adoption Polish
• Size: S
• Milestone: v2.2.0
• Target date: unset; no delivery date has been committed.
• Type: Bug

Agent assignment

Assignee: codeforester. This is review/backlog intake; implementation has not started.