Make macOS bindist configure more deterministic

GHC from a bindist requires running `./configure` and then `make
install`. One would assume that the result is always the same, in
particular if we run this twice on the same host with the same
environment variables. However, this is not the case. See #1461.

The fix is to set an environment variable telling `ar` and friends to
not futz around with timestamps in static library archives. This
environment variable is only necessary and only has an effect on
macOS, but there's no harm in setting it always. If the bindists stop
having a configure stage, or start using `libtool` instead of `ar` and
`ranlib`, then the fix will better be pushed within the bindists
themselves, using the `-D` flag to `libtool`, introduced in XCode
10.2.

Fixes #1461.

haskell/ghc_bindist.bzl

@@ -308,7 +308,18 @@ def _ghc_bindist_impl(ctx):
         # tools! This means that sed -i always takes an argument.
         execute_or_fail_loudly(ctx, ["sed", "-e", "s/RelocatableBuild = NO/RelocatableBuild = YES/", "-i.bak", "mk/config.mk.in"])
         execute_or_fail_loudly(ctx, ["./configure", "--prefix", bindist_dir.realpath])
-        execute_or_fail_loudly(ctx, ["make", "install"])
+        execute_or_fail_loudly(
+            ctx,
+            ["make", "install"],
+            # Necessary for deterministic builds on macOS. See
+            # https://blog.conan.io/2019/09/02/Deterministic-builds-with-C-C++.html.
+            # The proper fix is for the GHC bindist to always use ar
+            # and never use libtool, which has a -D flag for
+            # deterministic builds that works better than
+            # ZERO_AR_DATE. See
+            # https://source.chromium.org/chromium/chromium/src/+/62848c8d298690e086e49a9832278ff56b6976b5.
+            environment = {"ZERO_AR_DATE": "1"},
+        )
         ctx.file("patch_bins", executable = True, content = r"""#!/usr/bin/env bash
 find bin -type f -print0 | xargs -0 \
 grep --files-with-matches --null {bindist_dir} | xargs -0 -n1 \

haskell/private/workspace_utils.bzl

@@ -1,6 +1,6 @@
 load("@bazel_tools//tools/cpp:lib_cc_configure.bzl", "get_cpu_value")
 
-def execute_or_fail_loudly(repository_ctx, arguments):
+def execute_or_fail_loudly(repository_ctx, arguments, environment = {}):
     """Execute the given command
 
     Fails if the command does not exit with exit-code 0.
@@ -12,7 +12,7 @@ def execute_or_fail_loudly(repository_ctx, arguments):
       exec_result: The output of the command.
 
     """
-    exec_result = repository_ctx.execute(arguments, quiet = True)
+    exec_result = repository_ctx.execute(arguments, environment = environment, quiet = True)
     if exec_result.return_code != 0:
         arguments = [_as_string(x) for x in arguments]
         fail("\n".join(["Command failed: " + " ".join(arguments), exec_result.stderr]))