you can verify by downloading the archive and comparing the content of the archive with the content of the archive produced by git archive. The issue seems to be that the zip file contains the version of the zip utility used to create the file, so you'd need the exact same version to make a reproducible build.

That's interesting. I'm not able to replicate your results. Cloning that respository and doing the same git archive command produces an identical file to what GitHub serves.

I'm on a fully updated Arch Linux with the latest Git. If you have an older version, that might be making the difference.

I can reproduce the result: The content of the file is identical, the checksum differs.

> I'm on a fully updated Arch Linux with the latest Git.

Same, actually.

According to diffoscope, the (only) differences are in the archive member modification times:

  --- ../0.1.0.zip
  +++ 0.1.0.zip
  ├── zipinfo -v {}
  │ @@ -28,15 +28,15 @@
  │    file system or operating system of origin:      MS-DOS, OS/2 or NT FAT
  │    version of encoding software:                   0.0
  │    minimum file system compatibility required:     MS-DOS, OS/2 or NT FAT
  │    minimum software version required to extract:   1.0
  │    compression method:                             none (stored)
  │    file security status:                           not encrypted
  │    extended local header:                          no
  │ -  file last modified on (DOS date/time):          2016 Apr 8 06:33:12
  │ +  file last modified on (DOS date/time):          2016 Apr 8 14:33:12
  │    file last modified on (UT extra field modtime): 2016 Apr 8 13:33:13 local
  │    file last modified on (UT extra field modtime): 2016 Apr 8 13:33:13 UTC
  │    32-bit CRC value (hex):                         00000000
  │    compressed size:                                0 bytes
  │    uncompressed size:                              0 bytes
  │    length of filename:                             13 characters
  │    length of extra field:                          9 bytes
  │ @@ -63,15 +63,15 @@
  │    version of encoding software:                   0.0
  │    minimum file system compatibility required:     MS-DOS, OS/2 or NT FAT
  │    minimum software version required to extract:   1.0
  │    compression method:                             deflated
  │    compression sub-type (deflation):               normal
  │    file security status:                           not encrypted
  │    extended local header:                          no
  │ -  file last modified on (DOS date/time):          2016 Apr 8 06:33:12
  │ +  file last modified on (DOS date/time):          2016 Apr 8 14:33:12
  │    file last modified on (UT extra field modtime): 2016 Apr 8 13:33:13 local
  │    file last modified on (UT extra field modtime): 2016 Apr 8 13:33:13 UTC
  │    32-bit CRC value (hex):                         570b4391
  │    compressed size:                                52 bytes
  │    uncompressed size:                              78 bytes
  │    length of filename:                             23 characters
  │    length of extra field:                          9 bytes
  │ @@ -97,15 +97,15 @@
  │    file system or operating system of origin:      Unix
  │    version of encoding software:                   2.3
  │    minimum file system compatibility required:     MS-DOS, OS/2 or NT FAT
  │    minimum software version required to extract:   1.0
  │    compression method:                             none (stored)
  │    file security status:                           not encrypted
  │    extended local header:                          no
  │ -  file last modified on (DOS date/time):          2016 Apr 8 06:33:12
  │ +  file last modified on (DOS date/time):          2016 Apr 8 14:33:12
  │    file last modified on (UT extra field modtime): 2016 Apr 8 13:33:13 local
  │    file last modified on (UT extra field modtime): 2016 Apr 8 13:33:13 UTC
  │    32-bit CRC value (hex):                         bc890775
  │    compressed size:                                59 bytes
  │    uncompressed size:                              59 bytes
  │    length of filename:                             20 characters
  │    length of extra field:                          9 bytes

(rest of output omitted as it's too long for an HN comment; the full output can be found at http://paste.debian.net/432708/)

Timezone difference, with extra DST madness mixed in? 13:33 is UTC, 14:33 is UTC+DST, 06:33 is Pacific Time+DST

Thanks for spotting this. If I set TZ before running the command, I actually can reproduce the different result. Apparently I'm in the same time zone as GitHub :)

If you do "TZ=America/Los_Angeles git archive..." for a Zip file, you should then be capable of making a bit-exact file.

ZIP is a fun file format.