CycloneDX / CycloneDX/cyclonedx-rust-cargo
Trailing zeros in fractional digits of timestamp fails validation.
- Dominant language
- Rust
- Stars
- 178
- Forks
- 66
- PR merge metrics
- No merged PRs in 30d
Description
JSON Timestamps in cyclone-dx use the `date-time` format:
```
"timestamp": {
"type": "string",
"format": "date-time",
"title": "Timestamp",
"description": "The timestamp in which the action occurred"
}
```
The `date-time` format is described [here](https://json-schema.org/understanding-json-schema/reference/string.html#dates-and-times):
"date-time": Date and time together, for example, 2018-11-13T20:20:39+00:00

Using OWASP tools:
```
cyclonedx-win-x64.exe validate --input-file .\bom.json
Unable to validate against any JSON schemas.
BOM is not valid.
```
**The BOM will validate using both tools if I remove the trailing zeros from the fractional digits in output manually**:
E.g. going from:
`2022-12-21T23:54:20.218381200Z`
to
`2022-12-21T23:54:20.2183812Z`
Contributor guide
Research direction
Reproduce the validation failure with the timestamp shown in the issue, then locate the Rust entry point that serializes timestamps in generated CycloneDX BOMs. Compare output with and without trailing fractional zeros and verify the resulting BOM using the OWASP validation tools; done means timestamps with trailing zeros validate without manual editing.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100