Go template sprig date functions not defined about syft

[tgerla]

Hi @david-gherghita, thanks for the report. There is a similar discussion for Grype's templating capability here: anchore/grype#1243 -- it looks like the outcome is that we decided not to include the Sprig non-hermetic functions. I can run it by the team, but I believe we would come to the same conclusion for Syft. Can you describe in a bit more detail what you're trying to do, and maybe we can suggest an alternative?

[david-gherghita]

Hello @tgerla, thank you very much for your prompt response. I understand the situation.
What I am trying to achieve is to generate a slightly modified version of the CycloneDX 1.4 SBOM than you currently offer with the included format. For this, I need to also include the timestamp.
I noticed that for Grype the timestamp was included as a property of "Document.Descriptor": "Document.Descriptor.Timestamp". Do you think something like that could be done for syft too?

[wagoodman]

It looks like that cyclonedx documents already include a timestamp:

❯ syft alpine:3.12 -o [email protected] | jq '.metadata'
 ✔ Loaded image                                                                                                                                                alpine:3.12
 ✔ Parsed image                                                                                    sha256:cc604a625da1289c5dd57f947318133161ff7f40fb03dc2a649300473b97e743
 ✔ Cataloged packages              [15 packages]
{
  "timestamp": "2023-11-30T16:11:11-05:00",
  "tools": [
    {
      "vendor": "anchore",
      "name": "syft",
      "version": "0.98.0"
    }
  ],
  "component": {
    "bom-ref": "b0b5eff358e3ab6d",
    "type": "container",
    "name": "alpine",
    "version": "3.12"
  }
}

Is there another timestamp section that you're referring to?

[wagoodman]

@david-gherghita

We probably won't add the full set of non-hermetic functions to the template options, but we could add select now and date functions... would that be helpful?

[david-gherghita]

Hello @wagoodman,

That's exactly the timestamp I need, but I want to use it in my own output file, generated from a Go template. And so far I couldn't find a way to integrate the timestamp into the template.

These two functions now and date would fully meet my requirements; implementing them would resolve my issue.

Thank you.

[pdaran]

Hello, I would like to bump this issue..

I am also planning to make a more minimal SBOM and for that I need a timestamp and when possible the uuid for the serial number field of the output SBOM. (for example via the now and uuidv4 function of sprig).

A timestamp and uuid/serialNumber field in the descriptor of the SBOM would be sufficient :)