search

CycloneDX / cyclonedx-rust-cargo

Creates CycloneDX Software Bill of Materials (SBOM) from Rust (Cargo) projects
https://cyclonedx.org/
Apache License 2.0
96 stars 43 forks source link

Reproducible SBOMs #514

Open lfrancke opened 10 months ago

lfrancke commented 10 months ago

CycloneDX 1.6 (I believe) allows producing reproducible SBOMs by leaving out timestamps. We should add an option to allow the same.

drupol commented 4 months ago

I'm also looking for a solution here (context: https://github.com/nikstur/bombon/issues/92).

The serialNumber UUID attribute is also not reproducible.

lfrancke commented 3 months ago

We'd love to take a PR for this if you're interested. We can't promise that someone will get to it soon I'm afraid :(