Go template sprig date functions not defined

[david-gherghita]

What happened: I got the error <function "now" not defined> when running syft with a Go template that is using the "now" function, as explained on http://masterminds.github.io/sprig/date.html.

What you expected to happen: I expected to be able to use sprig date functions. It seems that "now", "date", "dateInZone" are not found, but "ago", "duration", "durationRound", "unixEpoch" are found.

Steps to reproduce the issue: sbom.go.tmpl: {{ now | unixEpoch }}

-> syft . -o template=sbom -t sbom.go.tmpl ✔ Indexed file system . ✔ Cataloged packages [0 packages] [0000] WARN no explicit name and version provided for directory source, deriving artifact ID from the given path (which is not ideal) [0000] WARN cataloger failed cataloger=sbom-cataloger error=sbom format not recognized location=/sbom 1 error occurred:

• failed to write SBOM: 1 error occurred:
• unable to write SBOM: unable to parse template: template: sbom.go.tmpl:1: function "now" not defined

Anything else we need to know?:

Environment:

• Output of syft version: Application: syft Version: 0.97.1 BuildDate: 2023-11-17T20:53:01Z GitCommit: Homebrew GitDescription: [not provided] Platform: darwin/arm64 GoVersion: go1.21.4 Compiler: gc
• OS (e.g: cat /etc/os-release or similar): sw_vers ProductName: macOS ProductVersion: 14.1.1 BuildVersion: 23B81

[tgerla]

Hi @david-gherghita, thanks for the report. There is a similar discussion for Grype's templating capability here: https://github.com/anchore/grype/issues/1243 -- it looks like the outcome is that we decided not to include the Sprig non-hermetic functions. I can run it by the team, but I believe we would come to the same conclusion for Syft. Can you describe in a bit more detail what you're trying to do, and maybe we can suggest an alternative?

[david-gherghita]

Hello @tgerla, thank you very much for your prompt response. I understand the situation. What I am trying to achieve is to generate a slightly modified version of the CycloneDX 1.4 SBOM than you currently offer with the included format. For this, I need to also include the timestamp. I noticed that for Grype the timestamp was included as a property of "Document.Descriptor": "Document.Descriptor.Timestamp". Do you think something like that could be done for syft too?

[wagoodman]

It looks like that cyclonedx documents already include a timestamp:

❯ syft alpine:3.12 -o cyclonedx-json@1.4 | jq '.metadata'
 ✔ Loaded image                                                                                                                                                alpine:3.12
 ✔ Parsed image                                                                                    sha256:cc604a625da1289c5dd57f947318133161ff7f40fb03dc2a649300473b97e743
 ✔ Cataloged packages              [15 packages]
{
  "timestamp": "2023-11-30T16:11:11-05:00",
  "tools": [
    {
      "vendor": "anchore",
      "name": "syft",
      "version": "0.98.0"
    }
  ],
  "component": {
    "bom-ref": "b0b5eff358e3ab6d",
    "type": "container",
    "name": "alpine",
    "version": "3.12"
  }
}

Is there another timestamp section that you're referring to?

[wagoodman]

@david-gherghita

We probably won't add the full set of non-hermetic functions to the template options, but we could add select now and date functions... would that be helpful?

[david-gherghita]

Hello @wagoodman,

That's exactly the timestamp I need, but I want to use it in my own output file, generated from a Go template. And so far I couldn't find a way to integrate the timestamp into the template.

These two functions now and date would fully meet my requirements; implementing them would resolve my issue.

Thank you.

[pdaran]

Hello, I would like to bump this issue..

I am also planning to make a more minimal SBOM and for that I need a timestamp and when possible the uuid for the serial number field of the output SBOM. (for example via the now and uuidv4 function of sprig).

A timestamp and uuid/serialNumber field in the descriptor of the SBOM would be sufficient :)

[pdaran]

Bump