investigate generating deterministic archives

the following tools exist
* https://salsa.debian.org/reproducible-builds/strip-nondeterminism
* https://github.com/keszybz/add-determinism

specifically from `strip-nondeterminism`
> File::StripNondeterminism is a Perl module for stripping bits of
nondeterministic information, such as timestamps and file system
order, from files such as gzipped files, ZIP archives, and Jar files.

so this is definitely a problem people have solved

by generating archives deterministically we'd be able to verify archives ports generate against known good checksums