Support microsecond timestamp resolution

[zbleness]

The dateTimeStamp XML standard type supports fractional second notation: https://www.w3.org/TR/xmlschema11-2/#dateTimeStamp

Before this patch, the tool crashed when fractional timestamps were given in e.g. CreationInfo.

Current implementation is limited to microsecond resolution. More fine-grained timestamps (nanosecond), will be silently truncated to microsecond resolution.

[zbleness]

PR Checks pass, please review.

[armintaenzertng]

Thanks for your contribution, @zbleness!

The SPDX spec is quite explicit with the format of the timestamp and defines YYYY-MM-DDThh:mm:ssZ as the format.
I'd read that such that no fractional seconds are allowed.

[zbleness]

Hi @armintaenzertng !

Afaik. the ISO8601 spec support fractional seconds too.
It is true that the SPDX HTML spec clearly defines a subset of the ISO8601 format for SPDX.
The problem is that it is not reflected in the JSON schemas which makes it hard to get consistent SBOMs from our vendors.

Would you be ok if we fix the schemas (all versions) instead for consistency?

Example (v2.2.1):

• https://github.com/spdx/spdx-spec/blob/development/v2.2.1/schemas/spdx-schema.json#L124
• https://github.com/spdx/spdx-spec/blob/development/v2.2.1/schemas/spdx-schema.json#L193
• https://github.com/spdx/spdx-spec/blob/development/v2.2.1/schemas/spdx-schema.json#L250
• https://github.com/spdx/spdx-spec/blob/development/v2.2.1/schemas/spdx-schema.json#L457
• https://github.com/spdx/spdx-spec/blob/development/v2.2.1/schemas/spdx-schema.json#L661

[armintaenzertng]

Changing the spec is not for me to decide. @goneall, what's your stance on this? Should we allow fractional seconds?

[goneall]

Changing the spec is not for me to decide. @goneall, what's your stance on this? Should we allow fractional seconds?

Changing the spec would involve creating an issue in the spdx-model repo and updating quite a few libraries.

Would you be ok if we fix the schemas (all versions) instead for consistency?

If the proposal is to update the schemas to reflect the SPDX subset of the XML datetimestamp, that seems like a reasonable approach.

[zbleness]

Changing the spec would involve creating an issue in the spdx-model repo and updating quite a few libraries.

Based on the proposed regex in this issue you seem to be adopting fractional seconds format (more ISO8601 compatibility). Do you really want a new issue that would propose quite the opposite (maintaining SPDX 2.3 timestamp => less ISO8601 compatibility)?

If the proposal is to update the schemas to reflect the SPDX subset of the XML datetimestamp, that seems like a reasonable approach.

To be clear, I would incorporate the format restriction from the HTML specs: YYYY-MM-DDThh:mm:ssZ and add some validation.