feat: respect env var $SOURCE_DATE_EPOCH when generating SBOM #1036

Activity

1. wolfv

   added

   enhancementNew feature or requestNew feature or request

   on Mar 31, 2026
2. jkowalleck

   added

   help wantedExtra attention is neededExtra attention is needed

   on Mar 31, 2026
3. jkowalleck commented on Mar 31, 2026

   

   jkowalleck

   on Mar 31, 2026

   Member

   More actions

   feel free to champion the feature

   relevant parts are here:

   cyclonedx-python/cyclonedx_py/_internal/cli.py

   Lines 218 to 223 in e42d0fe

   	if self._output_reproducible:
   	bom.metadata.properties.add(Property(name=PropertyName.Reproducible.value,
   	value=PropertyValue.BooleanTrue.value))
   	# dirty hacks to remove these mandatory properties
   	bom.serial_number = None # type:ignore[assignment]
   	bom.metadata.timestamp = None # type:ignore[assignment]
4. jkowalleck commented on Mar 31, 2026

   

   jkowalleck

   on Mar 31, 2026

   Member

   More actions

   lets discuss the expectations:

   I would expect that only if the CLI flag --output-reproducible is given, an env var SOURCE_DATE_EPOCH MAY be used.
   Otherwise, the existing behavior MUST be used.
   If the --output-reproducible and no valid env var SOURCE_DATE_EPOCH is present, the current behaviour MUST be used.
5. wolfv commented on Mar 31, 2026

   

   wolfv

   on Mar 31, 2026 · Hidden as off-topic

   Author

   show commentMore actions
6. jkowalleck

   changed the title [-]respect $SOURCE_DATE_EPOCH when generating SBOM[/-] [+]feat: respect env var `$SOURCE_DATE_EPOCH` when generating SBOM[/+] on Apr 13, 2026
7. jkowalleck

   linked a pull request that will close this issuefeat: respect env var `SOURCE_DATE_EPOCH` when generating reproducible output #1084on Sep 15, 2026
8. jkowalleck commented on Sep 15, 2026

   

   jkowalleck

   on Sep 15, 2026

   Member

   More actions

   • fixed per feat: respect env var SOURCE_DATE_EPOCH when generating reproducible output #1084
   • released per https://github.com/CycloneDX/cyclonedx-python/releases/tag/v7.4.0

   👍React with 👍1Reacted by Wolf Vollprecht
9. jkowalleck

   closed this as completedon Sep 15, 2026