feat: render property cdx:reproducible

src/builders.ts

@@ -267,12 +267,25 @@
     for (const toolC of this.makeToolCs()) {
       bom.metadata.tools.components.add(toolC)
     }
-    if (!this.reproducible) {
+    if (this.reproducible) {
+      bom.metadata.properties.add(
+        new Models.Property(
+          PropertyNames.BomReproducible,
+          PropertyValueBool.True
+        )
+      )
+    } else {
       bom.serialNumber = Utils.BomUtility.randomSerialNumber()
       bom.metadata.timestamp = new Date()
+      bom.metadata.properties.add(
+        new Models.Property(
+          PropertyNames.BomReproducible,
+          PropertyValueBool.False
+        )
+      )
     }
-    // endregion metadata
 
+    // endregion metadata
     // region components
     if (this.flattenComponents) {
       for (const c of allComponents.values()) {
@@ -288,7 +301,7 @@
     // endregion components
 
     // region dependency graph
     this.setNestedBomRefs(allComponents, pTree)
     this.makeDependencyGraph(allComponents, allPackages)
     // endregion dependency graph
 
@@ -319,7 +332,7 @@
       const bRefD = parts.join('')
       const bRefC = bRefCs[bRefD] = (bRefCs[bRefD] ?? 0) +1 /* eslint-disable-line no-multi-assign -- ack */
       component.bomRef.value = `${pref}${bRefD}${bRefC > 1 ? '#' + bRefC : ''}`
       this.setNestedBomRefs(allComponents, cTree, `${component.bomRef.value}|`)
     }
   }
 

src/properties.ts

@@ -29,6 +29,7 @@ export const enum PropertyNames {
   PackagePrivate = 'cdx:npm:package:private',
   PackageDevelopment = 'cdx:npm:package:development',
   PackageInstallPath = 'cdx:npm:package:path',
+  BomReproducible = 'cdx:reproducible',
 }
 
 /**