-
-
Notifications
You must be signed in to change notification settings - Fork 29
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
add property cdx:reproducible
#70
Conversation
Signed-off-by: Hervé Boutemy <hboutemy@apache.org>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
4882d32
to
da29800
Compare
@stevespringett could I get your opinion on this proposed property? |
Signed-off-by: Hervé Boutemy <hboutemy@apache.org>
|
||
| Property | Description | | ||
| -------- | ----------- | | ||
| `cdx:reproducible` | Whether the CycloneDX document has been generated in a reproducible manner: if so, then time- or random-based values MUST be omitted, and elements order SHOULD be reproducible. _Boolean value_. May appear once. | |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
What about using SOURCE_DATE_EPOCH
for time information?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
what about it?
all build-time information that is related to time
is optional in CycloneDX, so just omit it.
If you going to fake/pretend timestamps, then why bother making the document as "reproducible"?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The idea of it is to say "the date is when the source artifact was made/published/whatever". I suppose just omitting it here is fine, but not having to scrounge for some date information elsewhere would be useful I expect…
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
could you open a new issue for the topic, so we could discuss further?
please describe why you need the timestamp, for what you use it, and what you want to artificially base it of, and what role the "reproducible" flag plays in all that.
property introduced in CycloneDX/cyclonedx-property-taxonomy#70 Signed-off-by: Hervé Boutemy <hboutemy@apache.org>
property introduced in CycloneDX/cyclonedx-property-taxonomy#70 Signed-off-by: Hervé Boutemy <hboutemy@apache.org>
Purpose: flag a SBOM document or parts of it as reproducible.
reproducible SBOMs usually omit time-and random-based information, and might render elements in a reproducible order.
some implementations that can generate “reproducible” BOMs, by omitting time- and random-based values, ordering elements, and so on already exist.
caused by #69 (comment)