dpkg-source: Make the program reproducible when run standalone

Running dpkg-source directly is more common than running dpkg-deb
directly. In addition dpkg-source needs to parse the changelog anyway,
something that dpkg-deb does not need nor, in any case, has an easy way
to do currently.

So let's make it generate reproducible source by default.

debian/changelog

@@ -28,6 +28,8 @@ dpkg (1.18.11) UNRELEASED; urgency=medium
   * Implement source stanza substvars prefixed with S: in dpkg-gencontrol.
     These auto-generated variables map each source stanza field into an
     output substvar prefixed with “S:”.
+  * Make dpkg-source generate reproducible source packages when run
+    standalone, by honoring SOURCE_DATE_EPOCH.
   * Perl modules:
     - Obsolete Source-Version substvar in Dpkg::Substvars by emitting errors.
     - Rework keyring hooks in Dpkg::Vendor. Deprecate the keyrings hook, and

man/dpkg-source.man

@@ -771,6 +771,13 @@ of that fact.
 Patch files do not record permissions of files and thus modified
 permissions are not stored in the source package. This warning reminds you
 of that fact.
+.
+.SH ENVIRONMENT
+.TP
+.B SOURCE_DATE_EPOCH
+If set, it will be used as the timestamp (as seconds since the epoch) to
+clamp the mtime in the \fBtar\fP(5) file entries.
+.
 .SH FILE FORMATS
 .SS debian/source/format
 This file contains on a single line the format that should be used to

scripts/dpkg-source.pl

@@ -236,6 +236,9 @@ if ($options{opmode} =~ /^(build|print-format|(before|after)-build|commit)$/) {
     my $changelog = changelog_parse(%ch_options);
     my $control = Dpkg::Control::Info->new($controlfile);
 
+    # <https://reproducible-builds.org/specs/source-date-epoch/>
+    $ENV{SOURCE_DATE_EPOCH} ||= $changelog->{timestamp};
+
     my $srcpkg = Dpkg::Source::Package->new(options => \%options);
     my $fields = $srcpkg->{fields};