From 93146b062aafef7400e1c4aee46af6670fa25df4 Mon Sep 17 00:00:00 2001
From: "Danilo M." <danix@danix.xyz>
Date: Fri, 26 Jun 2026 12:05:33 +0200
Subject: mkwheels: resolve SOURCE_DATE_EPOCH from PyPI upload time

---
 mkwheels | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/mkwheels b/mkwheels
index 1692842..bbacb9b 100755
--- a/mkwheels
+++ b/mkwheels
@@ -55,3 +55,22 @@ python3 -m pip --version >/dev/null 2>&1 || {
 }
 
 echo "mkwheels: $pkg $ver -> $OUTPUT/$pkg-wheels-$ver.tar.gz"
+
+# Resolve SOURCE_DATE_EPOCH. Explicit arg wins; otherwise derive it from the
+# earliest file upload time of this version on PyPI (a real, reproducible,
+# release-tied timestamp).
+if [ -z "$epoch" ]; then
+    meta=$(curl -fsSL "https://pypi.org/pypi/$pkg/$ver/json") || {
+        echo "error: cannot fetch PyPI metadata for $pkg $ver" >&2
+        exit 1
+    }
+    iso=$(printf '%s' "$meta" \
+        | jq -r '[.urls[].upload_time_iso_8601] | sort | .[0] // empty')
+    [ -n "$iso" ] || {
+        echo "error: no upload time found for $pkg $ver on PyPI" >&2
+        exit 1
+    }
+    epoch=$(date -u -d "$iso" +%s)
+    echo "warning: epoch not given; using PyPI upload time $iso (epoch $epoch)" >&2
+fi
+export SOURCE_DATE_EPOCH="$epoch"
-- 
cgit v1.2.3