add property cdx:reproducible

[jkowalleck]

Purpose: flag a SBOM document or parts of it as reproducible.
reproducible SBOMs usually omit time-and random-based information, and might render elements in a reproducible order.

some implementations that can generate “reproducible” BOMs, by omitting time- and random-based values, ordering elements, and so on already exist.

• https://github.com/CycloneDX/cyclonedx-maven-plugin
• https://github.com/CycloneDX/cyclonedx-php-composer
• https://github.com/CycloneDX/cyclonedx-webpack-plugin
• https://github.com/CycloneDX/cyclonedx-node-npm

caused by #69 (comment)

[jkowalleck]

@stevespringett could I get your opinion on this proposed property?

[mathstuf]

What about using SOURCE_DATE_EPOCH for time information?

[jkowalleck]

what about it?
all build-time information that is related to time is optional in CycloneDX, so just omit it.

If you going to fake/pretend timestamps, then why bother making the document as "reproducible"?

[mathstuf]

The idea of it is to say "the date is when the source artifact was made/published/whatever". I suppose just omitting it here is fine, but not having to scrounge for some date information elsewhere would be useful I expect…

[jkowalleck]

could you open a new issue for the topic, so we could discuss further?
please describe why you need the timestamp, for what you use it, and what you want to artificially base it of, and what role the "reproducible" flag plays in all that.