rpm output ignores `SOURCE_DATE_EPOCH` when generating the `%changelog` date
This is a bug report related to reproducible builds (#1232).
FPM::Package::RPM#changelog is written to honour attributes[:source_date_epoch], but nothing ever populates it for an rpm build, so the entry is dated from the wall clock, which breaks reproducibility. rpm parses that date into the CHANGELOGTIME header, so identical inputs packaged on two different days produce two different .rpm files.
Tested with fpm 1.17.0; current main is unchanged in the relevant code.
We are trying to make our app fully reproducible, and this bug was one of the things we had to work around. We resorted to generating the changelog ourselves. But less manual plumbing like this would sure make things easier. https://github.com/mullvad/mullvadvpn-app/pull/10834
Source: jordansissel/fpm