Dune sometimes changes *.opam files in release mode

[glondu]

Expected Behavior

In "reproducible release mode" (-p or --release), Dune should not change *.opam files.

Actual Behavior

Dune sometimes changes these files.

Reproduction

$ wget https://github.com/ocaml/graphics/releases/download/5.1.2/graphics-5.1.2.tbz
$ tar xf graphics-5.1.2.tbz
$ cd graphics-5.1.2
$ git init && git add . && git commit -m "Initial commit"
$ dune build -p graphics
$ git diff
diff --git a/graphics.opam b/graphics.opam
index 0f53f1e..1386301 100644
--- a/graphics.opam
+++ b/graphics.opam
@@ -1,6 +1,6 @@
-version: "5.1.2"
 # This file is generated by dune, edit dune-project instead
 opam-version: "2.0"
+version: "5.1.2"
 synopsis: "The OCaml graphics library"
 description: """
 The graphics library provides a set of portable drawing
@@ -38,4 +38,4 @@ build: [
     "@doc" {with-doc}
   ]
 ]
-dev-repo: "git+https://github.com/ocaml/graphics.git"
\ No newline at end of file
+dev-repo: "git+https://github.com/ocaml/graphics.git"

Note that I took graphics as an example, but it happens in many other packages.

Specifications

• Version of dune (output of dune --version): 3.9.1 (dune --version actually returns n/a)
• Version of ocaml (output of ocamlc --version): 4.13.1
• Operating system (distribution and version): Debian sid (as of 2023-08-18)

Context

This was discovered by Debian QA, which checks that sources are not modified during build. Debian bug.

[glondu]

This problem is not fixed with 3.11.x, actually. The original repro case still applies.