RPM injects /usr/lib/.build-id/[hash] files into pacakges as part of Fedora's debuginfo approach. As we don't use these, I think we should make this behaviour conditional and disable it.
The .build-id is a unique value, so I believe it would break binary reproducibility. I would either remove it altogether or enable conditionally based on (hopefully coming in near future) variable BUILD_REPRODUCIBLE_BINARIES.
Patch: http://lists.openembedded.org/pipermail/openembedded-core/2017-July/140063.html
Merged in OE-Core 1bd3ed18379c330c1c733dc9f043dbbe8aa0d254.