Dpkg::Source::Archive: Fix reproducible source package support

We should make sure the generated tarball has its filenames sorted,
otherwise tar will use whatever order comes from the filesystem.

debian/changelog

@@ -36,6 +36,8 @@ dpkg (1.18.11) UNRELEASED; urgency=medium
     - Make the Dpkg::Substavars parse() method return the number of substvars
       parsed.
     - Add new set_field_substvars() method to Dpkg::Substvars.
+    - Fix reproducible source package support in Dpkg::Source::Archive, by
+      sorting the tar contents with --sort=name.
   * Packaging:
     - Add liblocale-gettext-perl to libdpkg-perl Recommends.
     - Wrap and document dependency relationships.

scripts/Dpkg/Source/Archive.pm

@@ -50,7 +50,7 @@ sub create {
     my $mtime = $opts{source_date} // $ENV{SOURCE_DATE_EPOCH} // time;
     # Call tar creation process
     $spawn_opts{delete_env} = [ 'TAR_OPTIONS' ];
-    $spawn_opts{exec} = [ 'tar', '-cf', '-', '--format=gnu',
+    $spawn_opts{exec} = [ 'tar', '-cf', '-', '--format=gnu', '--sort=name',
                           '--mtime', "\@$mtime", '--clamp-mtime', '--null',
                           '--numeric-owner', '--owner=0', '--group=0',
                           @{$opts{options}}, '-T', '-' ];