add property cdx:reproducible
#70
Conversation
Signed-off-by: Hervé Boutemy <hboutemy@apache.org>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
jkowalleck
force-pushed
the
cdx-reproducible
branch
from
4882d32
to
da29800
Compare
|
@stevespringett could I get your opinion on this proposed property? |
Signed-off-by: Hervé Boutemy <hboutemy@apache.org>
|
|
||
| | Property | Description | | ||
| | -------- | ----------- | | ||
| | `cdx:reproducible` | Whether the CycloneDX document has been generated in a reproducible manner: if so, then time- or random-based values MUST be omitted, and elements order SHOULD be reproducible. _Boolean value_. May appear once. | |
There was a problem hiding this comment.
What about using SOURCE_DATE_EPOCH for time information?
There was a problem hiding this comment.
what about it?
all build-time information that is related to time is optional in CycloneDX, so just omit it.
If you going to fake/pretend timestamps, then why bother making the document as "reproducible"?
There was a problem hiding this comment.
The idea of it is to say "the date is when the source artifact was made/published/whatever". I suppose just omitting it here is fine, but not having to scrounge for some date information elsewhere would be useful I expect…
There was a problem hiding this comment.
could you open a new issue for the topic, so we could discuss further?
please describe why you need the timestamp, for what you use it, and what you want to artificially base it of, and what role the "reproducible" flag plays in all that.
property introduced in CycloneDX/cyclonedx-property-taxonomy#70 Signed-off-by: Hervé Boutemy <hboutemy@apache.org>
property introduced in CycloneDX/cyclonedx-property-taxonomy#70 Signed-off-by: Hervé Boutemy <hboutemy@apache.org>
Purpose: flag a SBOM document or parts of it as reproducible.
reproducible SBOMs usually omit time-and random-based information, and might render elements in a reproducible order.
some implementations that can generate “reproducible” BOMs, by omitting time- and random-based values, ordering elements, and so on already exist.
caused by #69 (comment)