Investigate root cause of SBOMs from the Dark Ages

[alisonlomaka]

We occasionally receive SBOMs where the SPDX Created field has values with datestamps from year 1403. This suggests that the SBOM generation code is creating invalid timestamps under some circumstances. So far this has occurred for products related to iOS and Apple/Mac, so maybe it is related to a Mac build environment? Need to investigate the root cause of the anomalous dates and fix or determine if or how we should fix.

[KalleOlaviNiemitalo]

This DateTimeOffset.ToString call does not specify IFormatProvider:

sbom-tool/src/Microsoft.Sbom.Common/InternalMetadataProviderIdentityExtensions.cs

Line 160 in ee20a4e

return DateTimeOffset.UtcNow.ToString("yyyy-MM-ddTHH:mm:ssZ");

Perhaps it is using a calendar other than GregorianCalendar.

[KalleOlaviNiemitalo]

PersianCalendar started year 1404 a few days ago. In .NET 9.0.1 on Windows, PersianCalendar is the default calendar of these cultures:

Name	EnglishName
ckb-IR	Central Kurdish (Iran)
fa-AF	Persian (Afghanistan)
fa-IR	Persian (Iran)
lrc-IR	Northern Luri (Iran)
mzn-IR	Mazanderani (Iran)
ps-AF	Pashto (Afghanistan)
uz-Arab-AF	Uzbek (Arabic, Afghanistan)

even though PersianCalendar class claims "You cannot use a PersianCalendar object as the default calendar for a culture."

[KalleOlaviNiemitalo]

There is a code analyzer for finding mistakes like that. CA1305: Specify IFormatProvider

[KalleOlaviNiemitalo]

Apart from those cultures using PersianCalendar, there are also cultures using other default calendars:

Name	EnglishName	Calendar	Current year
ar-SA	Arabic (Saudi Arabia)	UmAlQuraCalendar	1446
th-TH	Thai (Thailand)	ThaiBuddhistCalendar	2568

Fixing the ToString call should help these too.

[JoseRenan]

Hey @KalleOlaviNiemitalo, nice catch, thanks! Would you be willing to make a contribution on this?

[KalleOlaviNiemitalo]

No I wouldn't.