Skip to content

add property cdx:reproducible #70

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jkowalleck merged 1 commit into from
Aug 20, 2023
Merged

add property cdx:reproducible #70

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 8 additions & 2 deletions cdx.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,13 @@
## `cdx` Namespace Taxonomy
# `cdx` Namespace Taxonomy

_Boolean value_ are `true` or `false`. Case sensitive.

| Property | Description |
| -------- | ----------- |
| `cdx:reproducible` | Whether the CycloneDX document has been generated in a reproducible manner: if so, then time- or random-based values MUST be omitted, and elements order SHOULD be reproducible. _Boolean value_. May appear once. |

@mathstuf mathstuf Aug 28, 2023

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What about using SOURCE_DATE_EPOCH for time information?

@jkowalleck jkowalleck Aug 28, 2023 •
edited
Loading

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what about it?
all build-time information that is related to time is optional in CycloneDX, so just omit it.

If you going to fake/pretend timestamps, then why bother making the document as "reproducible"?

@mathstuf mathstuf Aug 28, 2023

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The idea of it is to say "the date is when the source artifact was made/published/whatever". I suppose just omitting it here is fine, but not having to scrounge for some date information elsewhere would be useful I expect…

@jkowalleck jkowalleck Aug 29, 2023

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

could you open a new issue for the topic, so we could discuss further?
please describe why you need the timestamp, for what you use it, and what you want to artificially base it of, and what role the "reproducible" flag plays in all that.


| Namespace | Description | Administered By | Taxonomy |
| --- | --- | --- | --- |
| --------- | ----------- | --------------- | -------- |
| `cdx:composer` | Namespace for properties specific to the PHP Composer ecosystem. | CycloneDX PHP Maintainers | [cdx:composer taxonomy](cdx/composer.md) |
| `cdx:device` | Namespace for properties specific to hardware devices. | CycloneDX Core Working Group | [cdx:device taxonomy](cdx/device.md) |
| `cdx:gomod` | Namespace for properties specific to the Go Module ecosystem. | CycloneDX Go Maintainers | [cdx:gomod taxonomy](cdx/gomod.md) |
Expand Down