Makes CycloneDX SBOM Reproducible #369
Conversation
- Removes the serial number and timestamp in the FormatterReader.Read() function
|
I would like to solve #368 using the same method as this so I would like to see this get approved and then I will happily go in and use the same |
|
Now that we're fiddling with the outputted CycloneDX JSON, I think it'd be useful to have stronger tests around the validity of the CycloneDX output. Perhaps asserting that the output JSON exactly matches a known-good output or using CycloneDX JSON 1.3 and 1.4 parsers to validate that the JSON still parses as expected. In other words, we can be sure that our SBOM output is actually CycloneDX 1.3 or 1.4 by passing it to a tool or function that consumes that SBOM format and seeing the tool succeed in parsing the input. Edit: Resolved in recent commit using |
| @@ -53,6 +54,30 @@ func (f *FormattedReader) Read(b []byte) (int, error) { | |||
| return 0, fmt.Errorf("failed to format sbom: %w", err) | |||
| } | |||
|
|
|||
| // Makes CycloneDX SBOM more reproducible, see | |||
| // https://github.com/paketo-buildpacks/packit/issues/367 for more details. | |||
| if f.format.ID() == "cyclonedx-1.3-json" || f.format.ID() == "cyclonedx-1-json" { | |||
There was a problem hiding this comment.
That is the generic ID term for cycloneDX 1.4
Co-authored-by: Sophie Wigmore <swigmore@vmware.com>
| BOMFormat string `json:"bomFormat"` | ||
| SpecVersion string `json:"specVersion"` | ||
| SerialNumber string `json:"serialNumber"` | ||
| Metadata struct { | ||
| Timestamp string `json:"timestamp"` |
There was a problem hiding this comment.
Do you think it would be clearer if the serial number and timestamp fields were omitted if empty so they don't show up at all?
There was a problem hiding this comment.
I don't know I would test for their absence if they were omitted
There was a problem hiding this comment.
it's alright - tested this out in a build and the fields are omitted from the final JSON anyway.
|
Overall looks great, just nitpicks from me. |
|
LGTM. Deferring to other @paketo-buildpacks/tooling-maintainers for an approval since this is heavily borrowed from a spike I put together. |
function
Resolves #367
Checklist