#2154·fpm

rpm output ignores `SOURCE_DATE_EPOCH` when generating the `%changelog` date

Author: linus-mullvadCreated Jul 30, 2026Updated Jul 30, 2026

This is a bug report related to reproducible builds (#1232).

FPM::Package::RPM#changelog is written to honour attributes[:source_date_epoch], but nothing ever populates it for an rpm build, so the entry is dated from the wall clock, which breaks reproducibility. rpm parses that date into the CHANGELOGTIME header, so identical inputs packaged on two different days produce two different .rpm files.

Tested with fpm 1.17.0; current main is unchanged in the relevant code.

We are trying to make our app fully reproducible, and this bug was one of the things we had to work around. We resorted to generating the changelog ourselves. But less manual plumbing like this would sure make things easier. https://github.com/mullvad/mullvadvpn-app/pull/10834