Description
2.2 SBOM creation is automated and reproducible
means the SBOM must be reproducible, a good requirement for lvl2 and lvl3.
2.7 SBOM is timestamped
requires a timestamp for every level.
Timestamps are the bane of reproducibility.
Timestamps make the biggest source of reproducibility issues. Many build tools record the current date and time. The filesystem does, and most archive formats will happily record modification times on top of their own timestamps. It is also customary to record the date of the build in the software itself…
Timestamps are best avoided
https://reproducible-builds.org/docs/timestamps/
I can understand the desire for a timestamp but if it's included there needs to be details around the idea of SOURCE_DATE_EPOCH
(a timestamp based on the last modification to any of the source or some other fixed timestamp). It needs to be clearly explained that this is allowed for the timestamp and is in fact required once you require reproducibility for lvl2+.
https://reproducible-builds.org/docs/source-date-epoch/
Tangentially related to #9 request for more explanation