#35765 depends: hash local source contents

• Prevent depends from building stale local packages when developers share a source cache across worktrees
• Ensure depends reliably detects changes when files in local sources are modified or restored

This PR replaces mtime-based cache invalidation for local source packages in depends with content-addressed archives hashed via CMake. Generated tarballs are keyed by SHA256, allowing multiple worktrees to share a single `SOURCES_PATH` cache without collision or stale rebuilds.

Problem: Currently, depends uses `find -newer` against cached tarballs to detect changes in local source directories (such as `native_libmultiprocess`). When multiple worktrees share a source directory, or when files are deleted or restored without newer timestamps, depends fails to rebuild or reuses stale code from another worktree.

P3 · bug fix

• P3 because it prevents depends from reusing stale local package archives across git worktrees
• Impact is minor because native_libmultiprocess is currently the only package affected

Fixes depends cache invalidation when building local sources across worktrees (#35764). As noted by willcl-ark, 'timestamp comparisons can reuse an archive produced by another worktree, causing Depends to build stale local sources.' While helpful for developer workflows sharing depends sources, it is limited in scope as `native_libmultiprocess` is currently the only package utilizing `local_dir`.

Membership: Modifies depends build infrastructure (`depends/funcs.mk` and `depends/local_source.cmake`).

Factors: security/stability 0, bug 1, performance 0, user value 0, leverage 1

• Needs rebase before review because it currently has merge conflicts
• Author has been inactive for almost two months

The PR has merge conflicts, the 'Needs rebase' label, and has had no author activity for 57 days.

Author status: silent since 2026-07-22

• No review feedback or concept votes have been posted yet
• Only the author has commented to share build hashes and an open question on timestamps

No feedback or review comments have been left yet.

Only the author has commented on the PR to note a question about mtimes and post Guix build hashes.

Review verdicts (DrahtBot): 0

0 lines under test/bench/ci.

• depends/funcs.mk +24/-14
• depends/local_source.cmake +12/-0
• depends/packages.md +2/-1

PR #35765 modifies the depends build system to create deterministic, content-addressed archives of local directory sources using CMake, replacing mtime-based checks with SHA256 hashes. This fixes issue #35764 where sharing a depends source directory across worktrees causes stale packages to be built. The change primarily benefits developers testing local subtrees or multiprocess builds across multiple checkouts. The PR is marked as a draft, has merge conflicts, and has received no reviewer feedback since opening.