Normalize timezones in JSON output

This commit overrides the marshaling functions of the statement and
vex.VEX object to normalize the timezones to Zulu and comply better
with the in-toto guidelines (see https://github.com/in-toto/attestation/blob/main/docs/new_predicate_guidelines.md)

Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>

Author: puerco

pkg/vex/statement.go

@@ -6,6 +6,7 @@ SPDX-License-Identifier: Apache-2.0
 package vex
 
 import (
+	"encoding/json"
 	"fmt"
 	"sort"
 	"strings"
@@ -206,3 +207,27 @@ func (stmt *Statement) MatchesProduct(identifier, subidentifier string) bool {
 	}
 	return false
 }
+
+// MarshalJSON the document object overrides its marshaling function to normalize
+// the timezones in all dates to Zulu.
+func (stmt *Statement) MarshalJSON() ([]byte, error) {
+	type alias Statement
+	var ts, lu string
+
+	if stmt.Timestamp != nil {
+		ts = stmt.Timestamp.UTC().Format(time.RFC3339Nano)
+	}
+	if stmt.LastUpdated != nil {
+		lu = stmt.LastUpdated.UTC().Format(time.RFC3339Nano)
+	}
+
+	return json.Marshal(&struct {
+		*alias
+		TimeZonedTimestamp   string `json:"timestamp"`
+		TimeZonedLastUpdated string `json:"last_updated,omitempty"`
+	}{
+		alias:                (*alias)(stmt),
+		TimeZonedTimestamp:   ts,
+		TimeZonedLastUpdated: lu,
+	})
+}

pkg/vex/vex.go

@@ -132,6 +132,30 @@ func (vexDoc *VEX) ToJSON(w io.Writer) error {
 	return nil
 }
 
+// MarshalJSON the document object overrides its marshaling function to normalize
+// the timezones in all dates to Zulu.
+func (vexDoc *VEX) MarshalJSON() ([]byte, error) {
+	type alias VEX
+	var ts, lu string
+
+	if vexDoc.Timestamp != nil {
+		ts = vexDoc.Timestamp.UTC().Format(time.RFC3339)
+	}
+	if vexDoc.LastUpdated != nil {
+		lu = vexDoc.LastUpdated.UTC().Format(time.RFC3339)
+	}
+
+	return json.Marshal(&struct {
+		*alias
+		TimeZonedTimestamp   string `json:"timestamp"`
+		TimeZonedLastUpdated string `json:"last_updated,omitempty"`
+	}{
+		TimeZonedTimestamp:   ts,
+		TimeZonedLastUpdated: lu,
+		alias:                (*alias)(vexDoc),
+	})
+}
+
 // EffectiveStatement returns the latest VEX statement for a given product and
 // vulnerability, that is the statement that contains the latest data about
 // impact to a given product.