Deterministic zipfile

src/shiv/builder.py

@@ -31,13 +31,13 @@
 # N.B.: `importlib.resources.{contents,is_resource,path}` are deprecated in 3.11 and gone in 3.13.
 if sys.version_info < (3, 11):
     def iter_package_files(package: Union[str, ModuleType]) -> Iterator[Tuple[Path, str]]:
-        for bootstrap_file in importlib_resources.contents(bootstrap):
-            if importlib_resources.is_resource(bootstrap, bootstrap_file):
-                with importlib_resources.path(bootstrap, bootstrap_file) as path:
+        for bootstrap_file in sorted(importlib_resources.contents(package)):
+            if importlib_resources.is_resource(package, bootstrap_file):
+                with importlib_resources.path(package, bootstrap_file) as path:
                     yield (path, bootstrap_file)
 else:
     def iter_package_files(package: Union[str, ModuleType]) -> Iterator[Tuple[Path, str]]:
-        for resource in importlib_resources.files(package).iterdir():
+        for resource in sorted(importlib_resources.files(package).iterdir(), key=lambda r: r.name):
             if resource.is_file():
                 with importlib_resources.as_file(resource) as path:
                     yield (path, resource.name)

src/shiv/cli.py

@@ -219,14 +219,15 @@ def main(
             shutil.copy(Path(preamble).absolute(), bin_dir / Path(preamble).name)
 
         sources.append(Path(tmp_site_packages).absolute())
+        sources.sort()
+        hashes = {}
 
         if no_modify:
             # if no_modify is specified, we need to build a map of source files and their
             # sha256 hashes, to be checked at runtime:
-            hashes = {}
 
             for source in sources:
-                for path in source.rglob("**/*.py"):
+                for path in sorted(source.rglob("**/*.py")):
                     hashes[str(path.relative_to(source))] = hashlib.sha256(path.read_bytes()).hexdigest()
 
         # if entry_point is a console script, get the callable and null out the console_script variable