Make it reproducible

[nikstur]

Closes #92 #93

This should be enough for now to make the SBOM reproducible. In my simple tests only on the same machine, this resulted in reproducible outputs.

[drupol]

This seems to fix the broken check:

diff --git a/rust/transformer/src/cyclonedx.rs b/rust/transformer/src/cyclonedx.rs
index 3d84f1d..18f0cfd 100644
--- a/rust/transformer/src/cyclonedx.rs
+++ b/rust/transformer/src/cyclonedx.rs
@@ -26,8 +26,6 @@ impl CycloneDXBom {
         Self(Bom {
             components: Some(components.into()),
             metadata: Some(metadata_from_derivation(target)),
-            // Do not include a serial number to improve reproducibility.
-            serial_number: None,
             ..Bom::default()
         })
     }
-- 
2.44.0

Last thing to do, is to sort the JSON root attributes by default.

[nikstur]

This seems to fix the broken check

Yes but your patch also re-introduces the reproducibility issues ^^.

I tried a different approach, deriving a serial number from the outPath of the SBOM derivation.

[drupol]

Haha I did something similar in the meantime:

sbom = let
    sbomPath = inputs.bombon.lib.${system}.buildBom (pkgs.symlinkJoin {
      name = "imageContent";
      paths = [ pkgs.hello ];
    }) { };
  in pkgs.runCommand sbomPath.name {
    nativeBuildInputs = [ pkgs.jq pkgs.util-linux ];
  } ''
    jq --sort-keys '.components |= sort_by(.purl)' ${sbomPath} > sbom.json
    jq ".serialNumber=\"urn:uuid:$(${pkgs.util-linux}/bin/uuidgen -N ${sbomPath.outPath} --sha1 --namespace @url)\"" sbom.json > $out
  '';

[drupol]

Works perfectly :) removing all my jq hacks now !