feat(sbom): keep internal uuid to identify components

[knqyf263]

Description

There is no guarantee that this approach will reliably identify identical components. In the current implementation, it is possible for multiple components to have the same name and type.

To prevent this, I used BOM-Ref in CycloneDX using the BOM-Ref, but it does not work in SPDX, and furthermore, the BOM-Ref is optional and may not exist.

Currently, intermediate BOMs are used internally to abstract multiple SBOM implementations, and each component is assigned a UUID. This ensures that the same component can be reused.

Related PRs

• fix(sbom): export bom-ref when converting a package to a component #7340

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[knqyf263]

@DmitriyLewen @afdesk I'm not confident about this idea and would like to get thoughts before proceeding with implementation.

[DmitriyLewen]

Just make sure I got you right:

1. (current logic): we create core.Component for each component from SBOM file (when unmarshalling SBOM file).
2. (new logic): we will store UUID of these components in Package/Application/OS.
3. (current logic): we will check packages/applications/os as usual (vulnerabilities etc.)
4. (new logic): (for sbom formats): instead of creating new components for packages/applications/os - we will check each Packages/Applications and compare with original SBOM by UUID to use original component. In this case we will take only parsed/sorted components (packages/apps).

is this right?

---

The solution looks good, and “on paper” it should work.

[knqyf263]

Right. Other advantages are that types, properties etc. can also use the values of the original component.

[DmitriyLewen]

I think this is good solution.
let's try to implement this - I hope we won't find any hidden problems in this solution

[github-actions]

This PR is stale because it has been labeled with inactivity.

[github-actions]

This PR is stale because it has been labeled with inactivity.