> For the complete documentation index, see [llms.txt](https://docs.interlynk.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.interlynk.io/lynkctl/how-to-guides/reproducible.md).

# Reproducible SBOMs

By default an SBOM embeds a generation timestamp and a fresh serial number, so two runs over identical source produce different files. `--reproducible` makes the output deterministic.

***

## Generate a Reproducible SBOM

```bash
lynkctl generate . --reproducible -o sbom.cdx.json
```

With `--reproducible`, lynkctl uses a fixed timestamp, a content-derived serial number, and sorted collections. Running it twice over the same source produces a byte-identical SBOM. This makes the output suitable for content-addressable storage and for diffing one build against the next.

## Controlling the Timestamp

`--reproducible` still records a timestamp; it just makes it deterministic instead of "now". Set it explicitly with `--timestamp`, which takes an RFC-3339 value and is only valid alongside `--reproducible`:

```bash
lynkctl generate . --reproducible --timestamp 2023-11-14T22:13:20Z -o sbom.cdx.json
```

When `--timestamp` is omitted, lynkctl falls back to the `SOURCE_DATE_EPOCH` environment variable — the same convention used by reproducible-build toolchains:

```bash
SOURCE_DATE_EPOCH=1700000000 lynkctl generate . --reproducible -o sbom.cdx.json
```

## When to Use It

| Scenario                                                       | Use `--reproducible`? |
| -------------------------------------------------------------- | --------------------- |
| Content-addressable artifact storage                           | Yes                   |
| Diffing SBOMs across builds to spot real changes               | Yes                   |
| Verifying a build is bit-for-bit reproducible                  | Yes                   |
| Routine SBOM generation where the real wall-clock time matters | No                    |