On 2026-08-11, Emmanuel Bourg wrote: > Thinking further about it, instead of DateUtils.getNow() I'd suggest > adding a Project.getBuildDate() or Project.getDate() method. That > looks more natural and clearly communicates what the date > represents. Also the fact that getNow() returns a date that is not now > is a bit counterintuitive.
True. I'd opt for getBuildDate. > Regarding Project.isReproducibleBuild(), I’m not sure it's needed. One > could argue that builds should always be reproducible by default, so > there shouldn't be a strong use case for querying that state > explicitly. I've got such a case in the CycloneDX Antlib. The CycloneDX specification is explicitly designed to create non-reproducible SBOMs (the serial number is expected to change with every creation even if all other content stays the same[1]). Right now (i.e. in the git main branch) I only "break" the spec if the user explicitly asks for it. Stefan [1] https://cyclonedx.org/docs/1.7/json/#serialNumber - I just see I could completely skip it and conform to the spec, but I'm not sure tools really treat it as optional. --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
