Remove or disable check file-contains-date-and-time

[JanZerebecki]

Remove or by default disable check file-contains-date-and-time, because DATE and TIME are perfectly reproducible for years, because we patched gcc to use SOURCE_DATE_EPOCH instead of the build time. Instead it causes people to sometimes create patches that break reproducibility: https://src.opensuse.org/jengelh/schismtracker/pulls/1

[danigm]

Okay, so this is a check that we can filter for openSUSE, or do you think it's something that we can remove for everyone?

Right now this check just looks for today date in files like, "%b %e %Y": https://github.com/rpm-software-management/rpmlint/blob/main/rpmlint/checks/BuildRootAndDateCheck.py#L19

[JanZerebecki]

I think we can remove it for everyone, as if they care about if rebuilds change output they would build with SOURCE_DATE_EPOCH.

It seems how this is implemented we can only usefully remove both file-contains-date-and-time and file-contains-current-date together.

@bmwiedemann You have more experience here. It seems this matches the resolved date in the build output instead of the place holders DATE and TIME, as I initially assumed. So it currently also matches other ways that should be fixed. I assume the false positives are probably more than the real positives, but I'm not sure. Do you think it is still better to remove both checks?

[Conan-Kudo]

What was the point of this check in the first place?

[bmwiedemann]

Before the invention of SOURCE_DATE_EPOCH, the check helped people find occurences of __TIME__ to patch them out to avoid extra rebuilds/republishes in OBS. But that is no more needed for 5+ years.

[Conan-Kudo]

Yes, but OBS isn't the only build system in the world that might need this. I would say that a comment about what this check actually does and is for in the file would make sense and just turn it off by default in the rpmlint policy.

[JanZerebecki]

@Conan-Kudo, do you know of a build system that would need it? I can't think of one even in the abstract that would make sense.

@bmwiedemann, can you answer the question from my previous comment?

[Conan-Kudo]

People building with GitHub/GitLab/Jenkins/etc. would. Or Koji/Koschei? Or even COPR. Not all distributions do things the way OBS does.

[Conan-Kudo]

we patched gcc to use SOURCE_DATE_EPOCH

I'm pretty sure much distros haven't done this either.

[JanZerebecki]

How would those build systems be impacted? AFAIK they would not be. Also that gcc change is included upstream, so yes they do have that.

[ppisar]

I got bitten by this test today when I packaged software release which was released also today:

perl-RT-Client-REST.noarch: E: file-contains-current-date /usr/share/doc/perl-RT-Client-REST/CHANGES

Please at least demote this test to warning level as there can be false positives like this.