[ptxdist] [PATCH] report: make SBoMs reproducible

[Ladislav Michl <oss-lists@triops.cz>]

From: Ladislav Michl <ladis@triops.cz>

Use SOURCE_DATE_EPOCH for timestamp.

Signed-off-by: Ladislav Michl <ladis@triops.cz>
---
 scripts/report/cyclonedx_sbom.py | 7 +++++--
 scripts/report/sbom.py           | 8 +++++++-
 scripts/report/spdx_sbom.py      | 3 +--
 3 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/scripts/report/cyclonedx_sbom.py b/scripts/report/cyclonedx_sbom.py
index 28f31c480..8a2cc0a85 100644
--- a/scripts/report/cyclonedx_sbom.py
+++ b/scripts/report/cyclonedx_sbom.py
@@ -8,9 +8,9 @@
 
 import json
 from base64 import b64encode
-from datetime import datetime
 from os import path
 from shutil import copy
+from uuid import NAMESPACE_DNS, UUID, uuid5
 
 from cyclonedx.factory.license import LicenseFactory
 from cyclonedx.model import (
@@ -49,6 +49,9 @@ class CycloneDXSbomGenerator(SbomGenerator):
         self.lc_factory = LicenseFactory()
 
     def write(self, file, bom):
+        bom.serial_number = UUID(int=0)
+        content = JsonV1Dot6(bom).output_as_string(indent=2)
+        bom.serial_number = uuid5(uuid5(NAMESPACE_DNS, "sbom.ptxdist.org"), content)
         outputter = JsonV1Dot6(bom)
         file.write(outputter.output_as_string(indent=2).encode("utf-8"))
 
@@ -216,7 +219,7 @@ class CycloneDXSbomGenerator(SbomGenerator):
         document = Bom()
 
         document.metadata = BomMetaData(
-            timestamp=datetime.now(),
+            timestamp=self.timestamp(),
             properties=SortedSet(
                 [
                     Property(name="vendor", value=data["bsp"]["vendor"]),
diff --git a/scripts/report/sbom.py b/scripts/report/sbom.py
index 95a91c876..1c7790bac 100644
--- a/scripts/report/sbom.py
+++ b/scripts/report/sbom.py
@@ -7,7 +7,8 @@
 #
 
 import re
-from os import path
+from datetime import datetime, timezone
+from os import environ, path
 
 from report.generator import Generator
 from report.report import ReportException
@@ -104,6 +105,11 @@ class SbomGenerator(Generator):
                 patches.append((tag, patch))
         return patches
 
+    def timestamp(self):
+        if epoch := environ.get("SOURCE_DATE_EPOCH"):
+            return datetime.fromtimestamp(int(epoch), timezone.utc)
+        return datetime.now(timezone.utc)
+
     def setup_env(self):
         env = {}
         for tmp in self._env:
diff --git a/scripts/report/spdx_sbom.py b/scripts/report/spdx_sbom.py
index 252828bc5..958471b3b 100644
--- a/scripts/report/spdx_sbom.py
+++ b/scripts/report/spdx_sbom.py
@@ -8,7 +8,6 @@
 
 import hashlib
 import uuid
-from datetime import datetime, timezone
 from os import path
 from shutil import copy
 
@@ -145,7 +144,7 @@ class SpdxSbomGenerator(SbomGenerator):
     def build(self, data):
         creationInfo = spdx.SPDXCreationInfo()
         creationInfo.created = (
-            datetime.now(timezone.utc).replace(microsecond=0).isoformat().replace('+00:00', 'Z')
+            self.timestamp().replace(microsecond=0).isoformat().replace("+00:00", "Z")
         )
         creationInfo.creators = [
             f"Organization: {data['bsp']['vendor']}",
-- 
2.47.3