CycloneDX / cyclonedx-python

CycloneDX Software Bill of Materials (SBOM) generator for Python projects and environments
https://cyclonedx.org
Apache License 2.0
256 stars 67 forks source link

Add support for metadata timestamp #117

Closed coderpatros closed 4 years ago

coderpatros commented 4 years ago

When generating an SBOM a timestamp should be generated and added to the metadata element.

Example in JSON format

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.2",
  "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
  "version": 1,
  "metadata": {
    "timestamp": "2020-04-13T20:20:39+00:00"
  },
  "components": []
}

Example in XML format

<?xml version="1.0"?>
<bom serialNumber="urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79" version="1" xmlns="http://cyclonedx.org/schema/bom/1.2">
    <metadata>
        <timestamp>2020-04-07T07:01:00Z</timestamp>
    </metadata>
    <components />
</bom>

Changes to the JSON output are required here https://github.com/CycloneDX/cyclonedx-python/blob/e7c1cd9fa6a564b015d923b2219509bab9804cd1/cyclonedx/bom/generator.py#L43-L51

Changes to the XML output are required here https://github.com/CycloneDX/cyclonedx-python/blob/e7c1cd9fa6a564b015d923b2219509bab9804cd1/cyclonedx/bom/generator.py#L54-L73

coderpatros commented 4 years ago

@c0d3nh4ck

c0d3nh4ck commented 4 years ago

118 @coderpatros The checks failed because when the function build_json_bom is called in reader.py, it has only 1 argument. So, I suggest we also need to fix that. Can you suggest what to do next?

c0d3nh4ck commented 4 years ago

118 @coderpatros The fix is made to check if metadata has a value, but showing assertion error because the expected json and xml files are no updated. We need to make changes in https://github.com/CycloneDX/cyclonedx-python/blob/master/tests/resources/bom.xml file and same for json https://github.com/CycloneDX/cyclonedx-python/blob/master/tests/resources/bom.json.

c0d3nh4ck commented 4 years ago

118 @coderpatros The fix is made to check for metadata whether it is empty or not.

It has passed all the checks and now there are no conflicts.