Ensure that all cyclonedx components have bom-refs

[sambhav]

Signed-off-by: Sambhav Kothari skothari44@bloomberg.net

BOM-Refs are important for VEX to refer to components uniquely. This allows us to create an independent vex document and refer to components within the SBOM through a BOM Link (see https://cyclonedx.org/capabilities/bomlink/)

The current logic for setting the bom ref is -

• PURL + syft id as a qualifier if PURL exists
• syft artifact id otherwise.

cc: @stevespringett @coderpatros

This is needed for independent VEX documents in grype.

[sambhav]

Notes -

• At some point we will need to add fields to sbom.SBOM to add optional 'decode' source information. i.e. if syft decoded an sbom into its format model then it should have some metadata from the original sbom preserved. The main things we would need are the bom uuid.
• We would need to make bom-ref a part of the syft model at some point so that we can use it in grype for referring to components. At this point, we can move the current bom ref logic to a method in pkg.Package but I wanted to get something out in the meantime as these changes mean that the syft model may have to be slightly aware of the output presentation format.

[kzantow]

@samj1912 what if we always include the ID, something like bom-ref = fmt.Sprintf("%s-%s", p.PURL, p.ID())? This way we can have a more readable bom-ref and guarantee uniqueness?

[kzantow]

An odd thing: none of these golden examples actually include a PURL-based bom-ref; maybe something is wrong about the logic or none of them have populated PURLs?

[sambhav]

None of them have populated purls. if you run make validate-schema, you can see some actual examples.

[wagoodman]

I see, since the examples in the test suite aren't valid pURLs.

[wagoodman]

nice touch making this a pURL qualifier

[wagoodman]

Nice job @samj1912 ! I only made a couple of changes:

1. Updated the common format test fixtures to have an example of a valid pURL
2. Added a few tests for the bom-ref creation logic

[sambhav]

Thanks!