From 46c670d2a20ab5f90fdddcbe575dcabde3436ce8 Mon Sep 17 00:00:00 2001
From: Kleis Auke Wolthuizen <github@kleisauke.nl>
Date: Tue, 13 Oct 2026 15:28:09 +0200
Subject: [PATCH] Ensure reproducible builds

See: https://reproducible-builds.org/docs/source-date-epoch/
---
 build/posix.sh | 5 +++++
 build/wasm.sh  | 7 +++----
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/build/posix.sh b/build/posix.sh
index 85ada022..e888a5b3 100755
--- a/build/posix.sh
+++ b/build/posix.sh
@@ -86,6 +86,11 @@ elif [ "$DARWIN" = true ]; then
   export MAKEFLAGS="-j$(sysctl -n hw.logicalcpu)"
 fi
 
+# Ensure reproducible builds
+# https://reproducible-builds.org/docs/source-date-epoch/
+SOURCE_DATE_EPOCH="$(git -c safe.directory=${PACKAGE} -C ${PACKAGE} log -1 --pretty=%ct)" && \
+  export SOURCE_DATE_EPOCH
+
 # Expose target sysroot to CMake
 export TARGET_SYSROOT="${TARGET}"
 
diff --git a/build/wasm.sh b/build/wasm.sh
index 43d7f00f..22ce3ee9 100755
--- a/build/wasm.sh
+++ b/build/wasm.sh
@@ -5,7 +5,7 @@ set -e
 ## SPDX-License-Identifier: Apache-2.0
 
 source ./versions.properties
-VERSION_WASM_VIPS="${1:-HEAD}"
+VERSION_WASM_VIPS="${1:-master}"
 
 DIR="wasm-vips-${VERSION_WASM_VIPS}"
 TAG="wasm-vips:${VERSION_WASM_VIPS}"
@@ -13,10 +13,9 @@ TAG="wasm-vips:${VERSION_WASM_VIPS}"
 echo "Using ${TAG} to build libvips ${VERSION_VIPS}"
 cd "${0%/*}"
 
-# Download specific version of wasm-vips
+# Clone a specific version of wasm-vips
 if [ ! -d "$DIR" ]; then
-  mkdir "${DIR}"
-  curl -Ls https://github.com/kleisauke/wasm-vips/archive/${VERSION_WASM_VIPS}.tar.gz | tar xzC "${DIR}" --strip-components=1
+  git clone -b ${VERSION_WASM_VIPS} --depth 1 https://github.com/kleisauke/wasm-vips.git "${DIR}"
 fi
 
 # Check libvips versions match