[FEATURE] Ensure `bom-ref` for `Component` and `Vulnerability` have a (unique) value about cyclonedx-python-lib HOT 4 CLOSED

@madpah can't we use PURL string as the bom-ref for component? the specification do that in the examples. Could be better than generate a UUID and keep a trace of it, etc... see https://github.com/CycloneDX/specification/blob/master/tools/src/test/resources/1.4/valid-vulnerability-1.4.json

@damiencarol - we can't use a PURL in most circumstances, but the model provided for by this library allows that to be the case. This PR was a precursor to a full fix in jake btw.

from cyclonedx-python-lib.

will test it as soon as it's ready.
FYI: I'm working on making Jake importing works for https://github.com/DefectDojo/django-DefectDojo

from cyclonedx-python-lib.

some related thoughts: https://github.com/CycloneDX/cyclonedx-php-library/blob/master/docs/dev/decisions/BomDependencyDataModel.md

PHP implementation that assignes bom-refs and makes then unique on render time: https://github.com/CycloneDX/cyclonedx-php-library/blob/master/src/Core/Serialize/BomRefDiscriminator.php
and the unit tests for it: https://github.com/CycloneDX/cyclonedx-php-library/blob/52a8e7e642480429249f5ff3cd5944b80451e98b/tests/Core/Serialize/BaseSerializerTest.php#L113

from cyclonedx-python-lib.

@madpah can't we use PURL string as the bom-ref for component? the specification do that in the examples.
Could be better than generate a UUID and keep a trace of it, etc...
see https://github.com/CycloneDX/specification/blob/master/tools/src/test/resources/1.4/valid-vulnerability-1.4.json

from cyclonedx-python-lib.