respect $SOURCE_DATE_EPOCH when generating SBOM

[wolfv]

Is your feature request related to a problem? Please describe.

The timestamp should be set to $SOURCE_DATE_EPOCH env var, so that builds are deterministic and can be reproduced at some point in the future.

Describe the solution you'd like

More explanation here: https://reproducible-builds.org/docs/source-date-epoch/

[jkowalleck]

feel free to champion the feature

relevant parts are here:

cyclonedx-python/cyclonedx_py/_internal/cli.py

Lines 218 to 223 in e42d0fe

	if self._output_reproducible:
	bom.metadata.properties.add(Property(name=PropertyName.Reproducible.value,
	value=PropertyValue.BooleanTrue.value))
	# dirty hacks to remove these mandatory properties
	bom.serial_number = None # type:ignore[assignment]
	bom.metadata.timestamp = None # type:ignore[assignment]

[jkowalleck]

lets discuss the expectations:

I would expect that only if the CLI flag --output-reproducible is given, an env var SOURCE_DATE_EPOCH MAY be used.
Otherwise, the existing behavior MUST be used.
If the --output-reproducible and no valid env var SOURCE_DATE_EPOCH is present, the current behaviour MUST be used.

[wolfv]

Actually, I just saw that the very recent cargo cyclone generator has the feature: https://github.com/CycloneDX/cyclonedx-rust-cargo/blob/e58bd5590212f82c5b7e16dd3e2e819b0dbea5b1/cargo-cyclonedx/CHANGELOG.md?plain=1#L12-L13 - sorry again about the noise!