CycloneDX / CycloneDX/cyclonedx-rust-cargo
Reproducible SBOMs
Open
- Dominant language
- Rust
- Stars
- 178
- Forks
- 66
- PR merge metrics
- No merged PRs in 30d
Description
CycloneDX 1.6 (I believe) allows producing reproducible SBOMs by leaving out timestamps. We should add an option to allow the same.
Contributor guide
Research direction
Start by locating where the Rust Cargo plugin generates CycloneDX SBOM timestamps and review the CycloneDX 1.6 behavior described in the issue. Determine how an option should control omission of timestamps, then verify that enabling it produces reproducible SBOM output while the default remains unchanged.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100