sdist build: bump base image to debian 12 to have py3.10+

- debian 11 only has python 3.9, deb12 has py3.11
- pip install pip is no longer needed, atm apt has new enough pip
  - and on deb12, started getting "error: externally-managed-environment"
- faketime does not seem to work properly on debian 12
    (getting reproducibility issues for the tarball)
  - so instead we untar, fix the timestamps manually, and re-tar

contrib/build-linux/sdist/Dockerfile

@@ -1,4 +1,4 @@
-FROM debian:bullseye@sha256:43ef0c6c3585d5b406caa7a0f232ff5a19c1402aeb415f68bcd1cf9d10180af8
+FROM debian:bookworm@sha256:b877a1a3fdf02469440f1768cf69c9771338a875b7add5e80c45b756c92ac20a
 
 ENV LC_ALL=C.UTF-8 LANG=C.UTF-8
 ENV DEBIAN_FRONTEND=noninteractive
@@ -11,7 +11,6 @@ RUN apt-get update -q && \
         python3-pip \
         python3-setuptools \
         python3-venv \
-        faketime \
         && \
     rm -rf /var/lib/apt/lists/* && \
     apt-get autoremove -y && \

contrib/build-linux/sdist/make_sdist.sh

@@ -6,21 +6,20 @@ PROJECT_ROOT="$(dirname "$(readlink -e "$0")")/../../.."
 CONTRIB="$PROJECT_ROOT/contrib"
 CONTRIB_SDIST="$CONTRIB/build-linux/sdist"
 DISTDIR="$PROJECT_ROOT/dist"
+BUILDDIR="$CONTRIB_SDIST/build"
 LOCALE="$PROJECT_ROOT/electrum/locale"
 
 . "$CONTRIB"/build_tools_util.sh
 
 git -C "$PROJECT_ROOT" rev-parse 2>/dev/null || fail "Building outside a git clone is not supported."
 
-# note that at least py3.7 is needed, to have https://bugs.python.org/issue30693
+rm -rf "$BUILDDIR"
+mkdir -p "$BUILDDIR" "$DISTDIR"
+
 python3 --version || fail "python interpreter not found"
 
 break_legacy_easy_install
 
-# upgrade to modern pip so that it knows the flags we need.
-# (make_packages.sh will later install a pinned version of pip in a venv)
-python3 -m pip install --upgrade pip
-
 rm -rf "$PROJECT_ROOT/packages/"
 if ([ "$OMIT_UNCLEAN_FILES" != 1 ]); then
     "$CONTRIB"/make_packages.sh || fail "make_packages failed"
@@ -51,16 +50,32 @@ fi
 
     # note: .zip sdists would not be reproducible due to https://bugs.python.org/issue40963
     if ([ "$OMIT_UNCLEAN_FILES" = 1 ]); then
-        PY_DISTDIR="dist/_sourceonly" # The DISTDIR variable of this script is only used to find where the output is *finally* placed.
+        PY_DISTDIR="$BUILDDIR/dist1/_sourceonly" # The DISTDIR variable of this script is only used to find where the output is *finally* placed.
     else
-        PY_DISTDIR="dist"
+        PY_DISTDIR="$BUILDDIR/dist1"
     fi
-    TZ=UTC faketime -f '2000-11-11 11:11:11' python3 setup.py --quiet sdist --format=gztar --dist-dir="$PY_DISTDIR"
+    # build initial tar.gz
+    python3 setup.py --quiet sdist --format=gztar --dist-dir="$PY_DISTDIR"
+
+    VERSION=$("$CONTRIB"/print_electrum_version.py)
     if ([ "$OMIT_UNCLEAN_FILES" = 1 ]); then
-        VERSION=$("$CONTRIB"/print_electrum_version.py)
-        mv "dist/_sourceonly/Electrum-$VERSION.tar.gz" "dist/Electrum-sourceonly-$VERSION.tar.gz"
+        FINAL_DISTNAME="Electrum-sourceonly-$VERSION.tar.gz"
+    else
+        FINAL_DISTNAME="Electrum-$VERSION.tar.gz"
+    fi
+    if ([ "$OMIT_UNCLEAN_FILES" = 1 ]); then
+        mv "$PY_DISTDIR/Electrum-$VERSION.tar.gz" "$PY_DISTDIR/../$FINAL_DISTNAME"
         rmdir "$PY_DISTDIR"
     fi
+
+    # the initial tar.gz is not reproducible, see https://github.com/pypa/setuptools/issues/2133
+    # so we untar, fix timestamps, and then re-tar
+    mkdir -p "$BUILDDIR/dist2"
+    cd "$BUILDDIR/dist2"
+    tar -xzf "$BUILDDIR/dist1/$FINAL_DISTNAME"
+    find -exec touch -h -d '2000-11-11T11:11:11+00:00' {} +
+    GZIP=-n tar --sort=name -czf "$FINAL_DISTNAME" "Electrum-$VERSION/"
+    mv "$FINAL_DISTNAME" "$DISTDIR/$FINAL_DISTNAME"
 )