[openwrt/openwrt] build: add explicit timezone in CycloneDX SBOM

[LEDE Commits]

ansuel pushed a commit to openwrt/openwrt.git, branch openwrt-23.05:
https://git.openwrt.org/cc0527b36281e7347f4da1b1169e11e7215c8c60

commit cc0527b36281e7347f4da1b1169e11e7215c8c60
Author: Roman Azarenko <roman.azarenko at iopsys.eu>
AuthorDate: Tue Jun 4 18:00:03 2024 +0200

    build: add explicit timezone in CycloneDX SBOM
    
    The sender domain has a DMARC Reject/Quarantine policy which disallows
    sending mailing list messages using the original "From" header.
    
    To mitigate this problem, the original message has been wrapped
    automatically by the mailing list software.
    Per the CycloneDX 1.4 spec, the `metadata.timestamp` field contains
    the date/time when the BOM was created [1].
    
    Before the change, the value generated by the package-metadata.pl
    script would look like this:
    
            2024-06-03T15:51:10
    
    CycloneDX 1.4 relies on the JSON Schema specification version draft-07,
    which defines the `date-time` format [2] as derived from RFC 3339,
    section 5.6 [3]. In this format, the `time-offset` component is required,
    however in the original version of package-metadata.pl it is omitted.
    
    This is causing problems with OWASP Dependency-Track version 4.11.0 or
    newer, where it now validates submitted SBOMs against the JSON schema
    by default [4]. SBOMs with incorrect timestamp values are rejected with
    the following error:
    
            {
                "detail": "Schema validation failed",
                "errors": [
                    "$.metadata.timestamp: 2024-06-03T15:51:10 is an invalid date-time"
                ],
                "status": 400,
                "title": "The uploaded BOM is invalid"
            }
    
    Add explicit `Z` (UTC) timezone offset in the `timestamp` field
    to satisfy the CycloneDX schema.
    
    [1]: https://github.com/CycloneDX/specification/blob/1.4/schema/bom-1.4.schema.json#L116-L121
    [2]: https://json-schema.org/draft-07/draft-handrews-json-schema-validation-01#rfc.section.7.3.1
    [3]: https://datatracker.ietf.org/doc/html/rfc3339#section-5.6
    [4]: https://github.com/DependencyTrack/dependency-track/pull/3522
    
    Signed-off-by: Roman Azarenko <roman.azarenko at iopsys.eu>
    (cherry picked from commit 2ded629864de779df8ddd0224a875edf17f9fea5)
    Link: https://github.com/openwrt/openwrt/pull/15693
    Signed-off-by: Christian Marangi <ansuelsmth at gmail.com>
---
 scripts/package-metadata.pl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/package-metadata.pl b/scripts/package-metadata.pl
index b4855ce67a..1b46714afe 100755
--- a/scripts/package-metadata.pl
+++ b/scripts/package-metadata.pl
@@ -653,7 +653,7 @@ sub dump_cyclonedxsbom_json {
 		serialNumber => "urn:uuid:$uuid",
 		version => 1,
 		metadata => {
-			timestamp => gmtime->datetime,
+			timestamp => gmtime->datetime . 'Z',
 		},
 		"components" => [@components],
 	};