openvex / go-vex

Go module to generate and transform VEX documents
Apache License 2.0
34 stars 15 forks source link

Normalize timezones in JSON output #73

Closed puerco closed 11 months ago

puerco commented 11 months ago

This PR overrides the marshaling functions of the statement and vex.VEX object to normalize the timezones to Zulu and comply better with the in-toto predicate guidelines:

Timestamps SHOULD use RFC 3339 syntax with timezone "Z" and SHOULD clarify the meaning of the timestamp. For example, a field named timestamp is too ambiguous; a better name would be builtAt or allowedAt or scannedAt.

This is not a breaking change. It is just setting the timezones, no data loss or format changes are involved:

Format Before:

"timestamp": "2023-08-15T19:55:22.076684217-06:00"

Format After: (not the same date, just to contrast the TZ)

"timestamp": "2023-12-05T05:06:38.099731287Z"

Signed-off-by: Adolfo García Veytia (Puerco) puerco@chainguard.dev