From: Ladislav Michl <[email protected]> Use SOURCE_DATE_EPOCH for timestamp.
Signed-off-by: Ladislav Michl <[email protected]> --- scripts/report/cyclonedx_sbom.py | 7 +++++-- scripts/report/sbom.py | 8 +++++++- scripts/report/spdx_sbom.py | 3 +-- 3 files changed, 13 insertions(+), 5 deletions(-) diff --git a/scripts/report/cyclonedx_sbom.py b/scripts/report/cyclonedx_sbom.py index 28f31c480..8a2cc0a85 100644 --- a/scripts/report/cyclonedx_sbom.py +++ b/scripts/report/cyclonedx_sbom.py @@ -8,9 +8,9 @@ import json from base64 import b64encode -from datetime import datetime from os import path from shutil import copy +from uuid import NAMESPACE_DNS, UUID, uuid5 from cyclonedx.factory.license import LicenseFactory from cyclonedx.model import ( @@ -49,6 +49,9 @@ class CycloneDXSbomGenerator(SbomGenerator): self.lc_factory = LicenseFactory() def write(self, file, bom): + bom.serial_number = UUID(int=0) + content = JsonV1Dot6(bom).output_as_string(indent=2) + bom.serial_number = uuid5(uuid5(NAMESPACE_DNS, "sbom.ptxdist.org"), content) outputter = JsonV1Dot6(bom) file.write(outputter.output_as_string(indent=2).encode("utf-8")) @@ -216,7 +219,7 @@ class CycloneDXSbomGenerator(SbomGenerator): document = Bom() document.metadata = BomMetaData( - timestamp=datetime.now(), + timestamp=self.timestamp(), properties=SortedSet( [ Property(name="vendor", value=data["bsp"]["vendor"]), diff --git a/scripts/report/sbom.py b/scripts/report/sbom.py index 95a91c876..1c7790bac 100644 --- a/scripts/report/sbom.py +++ b/scripts/report/sbom.py @@ -7,7 +7,8 @@ # import re -from os import path +from datetime import datetime, timezone +from os import environ, path from report.generator import Generator from report.report import ReportException @@ -104,6 +105,11 @@ class SbomGenerator(Generator): patches.append((tag, patch)) return patches + def timestamp(self): + if epoch := environ.get("SOURCE_DATE_EPOCH"): + return datetime.fromtimestamp(int(epoch), timezone.utc) + return datetime.now(timezone.utc) + def setup_env(self): env = {} for tmp in self._env: diff --git a/scripts/report/spdx_sbom.py b/scripts/report/spdx_sbom.py index 252828bc5..958471b3b 100644 --- a/scripts/report/spdx_sbom.py +++ b/scripts/report/spdx_sbom.py @@ -8,7 +8,6 @@ import hashlib import uuid -from datetime import datetime, timezone from os import path from shutil import copy @@ -145,7 +144,7 @@ class SpdxSbomGenerator(SbomGenerator): def build(self, data): creationInfo = spdx.SPDXCreationInfo() creationInfo.created = ( - datetime.now(timezone.utc).replace(microsecond=0).isoformat().replace('+00:00', 'Z') + self.timestamp().replace(microsecond=0).isoformat().replace("+00:00", "Z") ) creationInfo.creators = [ f"Organization: {data['bsp']['vendor']}", -- 2.47.3
