Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

spdx_tools created field does not matches the specification #766

Closed
surendrapathak opened this issue Sep 29, 2023 · 1 comment · Fixed by #768
Closed

spdx_tools created field does not matches the specification #766

surendrapathak opened this issue Sep 29, 2023 · 1 comment · Fixed by #768

Comments

@surendrapathak
Copy link

spdx created specification expects

YYYY-MM-DDThh:mm:ssZ

as in the example:

Created: 2010-01-29T18:30:22Z

However, the current implementation does not produce time in the expected format.

Steps to reproduce

  1. Take attached example or sbom from scratch example and modify

Line 41: created=datetime.datetime.now(tz=datetime.timezone.utc),
Line 75: release_date=datetime.datetime.now(tz=datetime.timezone.utc),

  1. Build SBOM
  2. Resulting SBOM has
   "created": "2023-09-29T08:14:36+00:00Z",

This does not match the spec and is also warned by: https://tools.spdx.org/app/

test_sbom.py.zip

@licquia
Copy link
Collaborator

licquia commented Oct 4, 2023

This occurs with any timezone-aware Python datetime object.

Additionally, it highlights an additional bug. Passing in a timezone-aware datetime with a local timezone instead of UTC will produce results that are both syntactically and semantically incorrect; the equivalent of "3 pm EDT on October 4, 2023" would be reported as "2023-10-04T15:00:00-04:00Z", which is both not valid ISO 8601 and the completely wrong time.

licquia pushed a commit to licquia/tools-python that referenced this issue Oct 5, 2023
Fixes spdx#766.

Signed-off-by: Jeff Licquia <jeff@licquia.org>
armintaenzertng pushed a commit that referenced this issue Oct 12, 2023
Fixes #766.

Signed-off-by: Jeff Licquia <jeff@licquia.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants