Is there an option to automatically integrate the metadata.timestamp?

[seahr]

Part of the The Minimum Elements For a Software Bill of Materials (SBOM) is the Timestamp (Record of the date and time of the SBOM data assembly.; cf. page 9 of PDF), which makes a lot of sense:

Timestamp records when the data is assembled -- the point of the SBOM creation. These further support the origin of the data, and help identify updated versions of the SBOM. These data fields provide context to the SBOM data source, and can potentially be used to make trust determinations.

It is specified in the CycloneDX standard (XSD, cf. line 40 ff.) as:

<xs:element name="timestamp" type="xs:dateTime" minOccurs="0"><xs:annotation><xs:documentation>The date and time (timestamp) when the document was created.</xs:documentation></xs:annotation><xs:element>

Is there an option to automatically insert the timestamp as part of the metadata? Should we enable this as a feature?

If not: How do you handle timestamps while automatically generating sboms?

[jkowalleck]

it is already part of the next major version V4, which is in the pipeline.

see #112

missing the feature badly? feel free to implement it into the current version and pull request it.

[jkowalleck]

v4 was just released: https://github.com/CycloneDX/cyclonedx-php-composer/releases/tag/v4.0.0