Skip to content

lvl 2 and lvl 3 is impossible due to requiring both reproducability and non-reproducability of SBOMs #31

Open
@06kellyjac

Description

@06kellyjac

2.2 SBOM creation is automated and reproducible means the SBOM must be reproducible, a good requirement for lvl2 and lvl3.
2.7 SBOM is timestamped requires a timestamp for every level.

Timestamps are the bane of reproducibility.

Timestamps make the biggest source of reproducibility issues. Many build tools record the current date and time. The filesystem does, and most archive formats will happily record modification times on top of their own timestamps. It is also customary to record the date of the build in the software itself…

Timestamps are best avoided

https://reproducible-builds.org/docs/timestamps/

I can understand the desire for a timestamp but if it's included there needs to be details around the idea of SOURCE_DATE_EPOCH (a timestamp based on the last modification to any of the source or some other fixed timestamp). It needs to be clearly explained that this is allowed for the timestamp and is in fact required once you require reproducibility for lvl2+.

https://reproducible-builds.org/docs/source-date-epoch/

Tangentially related to #9 request for more explanation

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions