Re: [Buildroot] [PATCH] utils/generate-cyclonedx: add uuid as serialNumber

[Thomas Perale via buildroot <buildroot@buildroot.org>]

Hi Heiko,

Thanks for the submission !

In reply of:
> In CycloneDX the serialNumber field is an optional top-level field that
> uniquely identified a SBOM using a URN RFC 4122 UUID format.
> 

Initially I didn't include this field for reproducibility concerns: generating
an SBOM from the same configuration wouldn't generate the same output.

Of course this is exactly the goal of this field from the spec point of view
but I was concerned this could be an issue for Buildroot. So I didn't include
this field and thought it could be set by the end user if needed like other
fields such as:

- version
- metadata
- ...

One of the idea I thought about to solve this would be for user to be able to
define a template the `generate-cyclonedx` would take as basis for the
generation.

```json
{
  "serialNumber": "{uuid.uuid4().urn}",
  "metadata": {
    "timestamp": "{datetime.now}"
    "authors": {
      "name": "..."
    }
  }
}
```

But i don't know if it feasible or nice to deal with from a user point of view.

Is there a tool you are using that enforce setting this field ?

Also in the commit message I would include the link to the spec:

https://cyclonedx.org/docs/1.6/json/#serialNumber

PERALE Thomas
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot