mirror of
https://github.com/openwrt/openwrt.git
synced 2026-10-13 00:17:02 +04:00
John Crispin
712ff7ca89
Both SBOM generators produce a different file on every run, so the published .bom.cdx.json of an image and of a package feed never match a rebuild. dump_cyclonedxsbom_json() in scripts/package-metadata.pl has three causes. It draws the serial number from rand(), it takes the timestamp from the wall clock, and encode_json() follows the Perl hash order, which changes with the hash seed of each run. The last one alone reorders every key in the file. scripts/make-sbom.py has the first two causes, through uuid.uuid4() and datetime.utcnow(). Take the timestamp from SOURCE_DATE_EPOCH, which the build exports. Derive the serial number from the timestamp and the component list, so it stays a valid RFC 4122 identifier and still changes when the content changes. Sort the keys of the Perl output. Tested with the package index and the image manifest of an ipq40xx build. Two runs with the same SOURCE_DATE_EPOCH are now identical, two runs with different values differ, and the scripts exit with an error when the value is not a number. Both files differ between two runs without the change. Signed-off-by: John Crispin <john@phrozen.org>