Give more guarantees on the ordering of the tarball entries

[andreabedini]

So far I am sorting by timestamp but I should sort secondarily on package id too.

[andreabedini]

Of course we don't want to break everybody's index, so we need to understand what's the current order and guarantee it stays the same. Looking at CHaP it seems currently we have cabal files ordered by package-id (or I should say filepath) followed by all package.json files (again by package-id/filepath).

-rw-r--r-- foliage/foliage 20985 2022-10-21 00:00:00 plutus-core/1.1.0.0/plutus-core.cabal
-rw-r--r-- foliage/foliage  4489 2022-10-21 00:00:00 plutus-ledger-api/1.1.0.0/plutus-ledger-api.cabal
-rw-r--r-- foliage/foliage  4112 2022-10-21 00:00:00 plutus-tx/1.1.0.0/plutus-tx.cabal
-rw-r--r-- foliage/foliage  4642 2022-10-21 00:00:00 plutus-tx-plugin/1.1.0.0/plutus-tx-plugin.cabal
-rw-r--r-- foliage/foliage  2395 2022-10-21 00:00:00 prettyprinter-configurable/1.1.0.0/prettyprinter-configurable.cabal
-rw-r--r-- foliage/foliage  1714 2022-10-21 00:00:00 word-array/1.1.0.0/word-array.cabal
-rw-r--r-- foliage/foliage  1391 2022-10-21 00:00:00 plutus-core/1.1.0.0/package.json
-rw-r--r-- foliage/foliage  1396 2022-10-21 00:00:00 plutus-ledger-api/1.1.0.0/package.json
-rw-r--r-- foliage/foliage  1388 2022-10-21 00:00:00 plutus-tx/1.1.0.0/package.json
-rw-r--r-- foliage/foliage  1395 2022-10-21 00:00:00 plutus-tx-plugin/1.1.0.0/package.json
-rw-r--r-- foliage/foliage  1405 2022-10-21 00:00:00 prettyprinter-configurable/1.1.0.0/package.json
-rw-r--r-- foliage/foliage  1388 2022-10-21 00:00:00 word-array/1.1.0.0/package.json

We need to guarantee that this order is stable. At the moment this ordering is an incidental consequence of doing

  packageVersions <- getDirectoryFiles inputDir ["*/*/meta.toml"] >>= traverse something1
  cabalEntries <- foldMap something2 packageVersions
  metadataEntries <- forP packageVersions something3
  let tarContents = Tar.write $ sortOn Tar.entryTime (cabalEntries ++ metadataEntries)

That forP is concering, there could be multiple packages added with the same timestamp and their relative order might not be guaranteed. getDirectoryFiles seems to do some sorting in its implementation but I am not sure we can call this a guarantee.