Re: [ptxdist] [APPLIED] report: make SBoMs reproducible

[Michael Olbrich <m.olbrich@pengutronix.de>]

Thanks, applied as 4121943f0d4d0c59c082c87cd51eb32291d6629c.

Michael

[sent from post-receive hook]

On Fri, 13 Nov 2026 09:38:36 +0100, Ladislav Michl <oss-lists@triops.cz> wrote:
> Use SOURCE_DATE_EPOCH for timestamp.
> 
> Signed-off-by: Ladislav Michl <ladis@triops.cz>
> Message-Id: <atNKL-2RFyKTjz1Q@lenoch>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/scripts/report/cyclonedx_sbom.py b/scripts/report/cyclonedx_sbom.py
> index 28f31c480b47..8a2cc0a85900 100644
> --- a/scripts/report/cyclonedx_sbom.py
> +++ b/scripts/report/cyclonedx_sbom.py
> @@ -8,9 +8,9 @@
>  
>  import json
>  from base64 import b64encode
> -from datetime import datetime
>  from os import path
>  from shutil import copy
> +from uuid import NAMESPACE_DNS, UUID, uuid5
>  
>  from cyclonedx.factory.license import LicenseFactory
>  from cyclonedx.model import (
> @@ -49,6 +49,9 @@ class CycloneDXSbomGenerator(SbomGenerator):
>          self.lc_factory = LicenseFactory()
>  
>      def write(self, file, bom):
> +        bom.serial_number = UUID(int=0)
> +        content = JsonV1Dot6(bom).output_as_string(indent=2)
> +        bom.serial_number = uuid5(uuid5(NAMESPACE_DNS, "sbom.ptxdist.org"), content)
>          outputter = JsonV1Dot6(bom)
>          file.write(outputter.output_as_string(indent=2).encode("utf-8"))
>  
> @@ -216,7 +219,7 @@ class CycloneDXSbomGenerator(SbomGenerator):
>          document = Bom()
>  
>          document.metadata = BomMetaData(
> -            timestamp=datetime.now(),
> +            timestamp=self.timestamp(),
>              properties=SortedSet(
>                  [
>                      Property(name="vendor", value=data["bsp"]["vendor"]),
> diff --git a/scripts/report/sbom.py b/scripts/report/sbom.py
> index 95a91c876a90..1c7790baca6b 100644
> --- a/scripts/report/sbom.py
> +++ b/scripts/report/sbom.py
> @@ -7,7 +7,8 @@
>  #
>  
>  import re
> -from os import path
> +from datetime import datetime, timezone
> +from os import environ, path
>  
>  from report.generator import Generator
>  from report.report import ReportException
> @@ -104,6 +105,11 @@ class SbomGenerator(Generator):
>                  patches.append((tag, patch))
>          return patches
>  
> +    def timestamp(self):
> +        if epoch := environ.get("SOURCE_DATE_EPOCH"):
> +            return datetime.fromtimestamp(int(epoch), timezone.utc)
> +        return datetime.now(timezone.utc)
> +
>      def setup_env(self):
>          env = {}
>          for tmp in self._env:
> diff --git a/scripts/report/spdx_sbom.py b/scripts/report/spdx_sbom.py
> index 252828bc5136..958471b3bb4e 100644
> --- a/scripts/report/spdx_sbom.py
> +++ b/scripts/report/spdx_sbom.py
> @@ -8,7 +8,6 @@
>  
>  import hashlib
>  import uuid
> -from datetime import datetime, timezone
>  from os import path
>  from shutil import copy
>  
> @@ -145,7 +144,7 @@ class SpdxSbomGenerator(SbomGenerator):
>      def build(self, data):
>          creationInfo = spdx.SPDXCreationInfo()
>          creationInfo.created = (
> -            datetime.now(timezone.utc).replace(microsecond=0).isoformat().replace('+00:00', 'Z')
> +            self.timestamp().replace(microsecond=0).isoformat().replace("+00:00", "Z")
>          )
>          creationInfo.creators = [
>              f"Organization: {data['bsp']['vendor']}",