Merge pull request #852 from Shnatsel/reproducible-builds

Reproducible builds MVP

Author: Shnatsel

Cargo.lock

@@ -34,6 +34,7 @@ percent-encoding = "2.3.1"
 purl = { version = "0.1.3", default-features = false, features = ["package-type"] }
 regex = "1.9.3"
 serde = { version = "1.0.193", features = ["derive"] }
+time = "0.3.36"
 thiserror = "2.0.0"
 validator = { version = "0.19.0" }
 

cargo-cyclonedx/Cargo.toml

@@ -24,6 +24,11 @@ pub enum Opts {
 #[derive(Parser, Debug)]
 #[clap(version)]
 #[clap(group(ArgGroup::new("dependencies-group").required(false).args(&["all", "top-level"])))]
+// TODO: replace with clap's Arg::env in 0.6.x after a semver break
+#[command(
+    after_help = "The SOURCE_DATE_EPOCH env var is honored to enable reproducible builds,\n\
+    see https://reproducible-builds.org/docs/source-date-epoch/"
+)]
 pub struct Args {
     /// Path to Cargo.toml
     #[clap(long = "manifest-path", value_name = "PATH", value_hint = clap::ValueHint::FilePath)]

cargo-cyclonedx/src/cli.rs

@@ -186,6 +186,14 @@ impl SbomGenerator {
         dep_kinds: &DependencyKindMap,
     ) -> Result<(Bom, TargetKinds), GeneratorError> {
         let mut bom = Bom::default();
+
+        // If we're in reproducible build mode, do not include the random serial number
+        // TODO: make it part of SBOM config instead in the next semver break
+        // due to https://github.com/PyO3/maturin/issues/3091
+        if let Ok(_) = std::env::var("SOURCE_DATE_EPOCH") {
+            bom.serial_number = None;
+        }
+
         let root_package = &packages[package];
 
         let components: Vec<_> = packages
@@ -512,6 +520,23 @@ impl SbomGenerator {
         let authors = Self::create_authors(package);
 
         let mut metadata = Metadata::new()?;
+
+        // If we're in reproducible build mode, use a fixed timestam provided by the environment.
+        // This is needed for Linux distributions: https://github.com/CycloneDX/cyclonedx-rust-cargo/issues/850
+        // Specification: https://reproducible-builds.org/docs/source-date-epoch/
+        //
+        // TODO: make it part of SBOM config instead in the next semver break
+        // due to https://github.com/PyO3/maturin/issues/3091
+        if let Ok(timestamp) = std::env::var("SOURCE_DATE_EPOCH") {
+            let timestamp =
+                i64::from_str_radix(&timestamp, 10).expect("Invalid reproducible build timestamp");
+            let datetime = time::OffsetDateTime::from_unix_timestamp(timestamp).unwrap();
+            let time_str = datetime
+                .format(&time::format_description::well_known::Iso8601::DEFAULT)
+                .unwrap();
+            metadata.timestamp = Some(time_str.try_into().unwrap());
+        }
+
         if !authors.is_empty() {
             metadata.authors = Some(authors);
         }