Thanks for this change and reminder of the effects on reproducibility when additional build info is added.

Related: go1.18 will introduce: https://tip.golang.org/doc/go1.18#debug/buildinfo

"... The new debug/buildinfo package provides access to module versions, version control information, and build flags embedded in executable files built by the go command. The same information is also available via runtime/debug.ReadBuildInfo for the currently running binary and via go version -m on the command line.

The data returned by go version -m can include vcs info (if present and not supressed) including commit timestamp:

    build   vcs=git
    build   vcs.revision=9262719092d6ec8e034c7a097575defe8611dadb
    build   vcs.time=2022-02-05T16:41:43Z
    build   vcs.modified=false

Fortunately it does not include a dynamic build time.

When go1.18+ is the default Go compiler, I think it will make sense to deprecate/remove custom added Go build info from Go application packages where possible, except where the application relies on it. The combination of debug/buildinfo and RPM package metadata should provide the necessary info in most cases.