From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Fri, 13 Nov 2026 09:38:59 +0100 Received: from metis.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::104]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1xRmoE-00AM6K-2e for lore@lore.pengutronix.de; Fri, 13 Nov 2026 09:38:59 +0100 Received: from [127.0.0.1] (helo=metis.whiteo.stw.pengutronix.de) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1xRmoB-0003vS-4P; Fri, 13 Nov 2026 09:38:55 +0100 Received: from mx1.white.stw.pengutronix.de ([2a0a:edc0:0:b01:1d::107]) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1xRmns-0002zE-NQ for ptxdist@pengutronix.de; Fri, 13 Nov 2026 09:38:36 +0100 Received: from dude05.red.stw.pengutronix.de (dude05.red.stw.pengutronix.de [IPv6:2a0a:edc0:0:1101:1d::54]) (Authenticated sender: relay-from-dude05.red.stw.pengutronix.de) by mx1.white.stw.pengutronix.de (Postfix) with ESMTPSA id A6566201544; Fri, 13 Nov 2026 09:38:36 +0100 (CET) ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=pengutronix.de; s=20260414; t=1794559116; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=t6ZA9tROfNvl2XT1roWAWcoHPjk7/vMdNqCmLMn6mQE=; b=NBzq/8T+mYjnIy8JAb3DCXlJcLGGCXSXnjXRxblcTPdzF4DPcSV65dKSMb0RVAYuNSE7A6 AZ8jORbG47BKFdY/bqBKODhuxVFtAwBYlCo5AG9FHD2hyHWwZ9phBr2dlvKFdCK/aX2uof qDQTkdVHHltH9Cv0J0DwwPXnsoPQlrtQ24OR9xIPpAEj9aoRfaU25uRQKL7h3cTior8xaR FxWIsL4Yxh9azzs0gI4MvSHzwPSjHVx/Siy0VGePFCCuswqzFqbTBQlL5ojCfSXuH2KLD8 bp16aqxLPZ/GTgOCjgwZ6XKu06tG7GFv4N07+alTjaj93dPvQwd+hRwe4WfVlQ== ARC-Seal: i=1; s=20260414; d=pengutronix.de; t=1794559116; a=rsa-sha256; cv=none; b=T8ijFWLGkwTfxLgkyZxP9zpzqH3j7mj6+bBQWaPDEhUQS2djn39PYG++Uxia7CnTVbXe3G JY1iJ5WrvoHfv+GkehRA2bHOi/3DLuCou50wDH8b3DoFpvxrV8zFbEnXRNJ7RNYTp8B7aC FBzdo6MbFdVOnlrSxmeAYUyTKiyBLUZOhFnndVlDAbYfRxNluZHLPmVF7jDSsApfJPxQjz VoEaei5l6OLuxmcZmTPNcFG/GAaADnzQj9GWEHwRDI+lXkTkeicBA8D+wh7LwzXx1dKXbo pCfcp+vW6D9eSCHrNw8z4nFeI99PdiNywa6D6PZ2rZWLR2Xi3KV6Rf+wSgBQ7Q== ARC-Authentication-Results: i=1; ORIGINATING; auth=pass smtp.auth=relay-from-dude05.red.stw.pengutronix.de smtp.mailfrom=mol@pengutronix.de Received: by dude05.red.stw.pengutronix.de (Postfix, from userid 1014) id 9884A743103; Fri, 13 Nov 2026 09:38:36 +0100 (CET) From: Michael Olbrich To: ptxdist@pengutronix.de Date: Fri, 13 Nov 2026 09:38:36 +0100 Message-ID: <20261113083836.1377771-1-m.olbrich@pengutronix.de> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Subject: Re: [ptxdist] [APPLIED] report: make SBoMs reproducible X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Cc: Ladislav Michl Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.whiteo.stw.pengutronix.de); SAEximRunCond expanded to false Thanks, applied as 4121943f0d4d0c59c082c87cd51eb32291d6629c. Michael [sent from post-receive hook] On Fri, 13 Nov 2026 09:38:36 +0100, Ladislav Michl wrote: > Use SOURCE_DATE_EPOCH for timestamp. > > Signed-off-by: Ladislav Michl > Message-Id: > Signed-off-by: Michael Olbrich > > diff --git a/scripts/report/cyclonedx_sbom.py b/scripts/report/cyclonedx_sbom.py > index 28f31c480b47..8a2cc0a85900 100644 > --- a/scripts/report/cyclonedx_sbom.py > +++ b/scripts/report/cyclonedx_sbom.py > @@ -8,9 +8,9 @@ > > import json > from base64 import b64encode > -from datetime import datetime > from os import path > from shutil import copy > +from uuid import NAMESPACE_DNS, UUID, uuid5 > > from cyclonedx.factory.license import LicenseFactory > from cyclonedx.model import ( > @@ -49,6 +49,9 @@ class CycloneDXSbomGenerator(SbomGenerator): > self.lc_factory = LicenseFactory() > > def write(self, file, bom): > + bom.serial_number = UUID(int=0) > + content = JsonV1Dot6(bom).output_as_string(indent=2) > + bom.serial_number = uuid5(uuid5(NAMESPACE_DNS, "sbom.ptxdist.org"), content) > outputter = JsonV1Dot6(bom) > file.write(outputter.output_as_string(indent=2).encode("utf-8")) > > @@ -216,7 +219,7 @@ class CycloneDXSbomGenerator(SbomGenerator): > document = Bom() > > document.metadata = BomMetaData( > - timestamp=datetime.now(), > + timestamp=self.timestamp(), > properties=SortedSet( > [ > Property(name="vendor", value=data["bsp"]["vendor"]), > diff --git a/scripts/report/sbom.py b/scripts/report/sbom.py > index 95a91c876a90..1c7790baca6b 100644 > --- a/scripts/report/sbom.py > +++ b/scripts/report/sbom.py > @@ -7,7 +7,8 @@ > # > > import re > -from os import path > +from datetime import datetime, timezone > +from os import environ, path > > from report.generator import Generator > from report.report import ReportException > @@ -104,6 +105,11 @@ class SbomGenerator(Generator): > patches.append((tag, patch)) > return patches > > + def timestamp(self): > + if epoch := environ.get("SOURCE_DATE_EPOCH"): > + return datetime.fromtimestamp(int(epoch), timezone.utc) > + return datetime.now(timezone.utc) > + > def setup_env(self): > env = {} > for tmp in self._env: > diff --git a/scripts/report/spdx_sbom.py b/scripts/report/spdx_sbom.py > index 252828bc5136..958471b3bb4e 100644 > --- a/scripts/report/spdx_sbom.py > +++ b/scripts/report/spdx_sbom.py > @@ -8,7 +8,6 @@ > > import hashlib > import uuid > -from datetime import datetime, timezone > from os import path > from shutil import copy > > @@ -145,7 +144,7 @@ class SpdxSbomGenerator(SbomGenerator): > def build(self, data): > creationInfo = spdx.SPDXCreationInfo() > creationInfo.created = ( > - datetime.now(timezone.utc).replace(microsecond=0).isoformat().replace('+00:00', 'Z') > + self.timestamp().replace(microsecond=0).isoformat().replace("+00:00", "Z") > ) > creationInfo.creators = [ > f"Organization: {data['bsp']['vendor']}",