From 4ffde9f891110f577213b04cc00c27ca468cc771 Mon Sep 17 00:00:00 2001
From: swadaptive <268603322+swadaptive@users.noreply.github.com>
Date: Tue, 1 Sep 2026 18:46:32 +0100
Subject: [PATCH] Add source-distribution external reference to components

Signed-off-by: swadaptive <268603322+swadaptive@users.noreply.github.com>
---
 .../format/internal/cyclonedxutil/helpers/component.go | 10 +++++++++-
 .../cyclonedxutil/helpers/external_references.go       |  1 +
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/syft/format/internal/cyclonedxutil/helpers/component.go b/syft/format/internal/cyclonedxutil/helpers/component.go
index 2e289fc84..dc788f5ba 100644
--- a/syft/format/internal/cyclonedxutil/helpers/component.go
+++ b/syft/format/internal/cyclonedxutil/helpers/component.go
@@ -47,6 +47,14 @@ func EncodeComponent(p pkg.Package, supplier string, locationSorter func(a, b fi
 		componentType = cyclonedx.ComponentTypeMachineLearningModel
 	}
 
+	externalRefs := encodeExternalReferences(p)
+	if srcRef := encodeSourcePackageExternalReference(p); srcRef != nil {
+		if externalRefs == nil {
+			externalRefs = &[]cyclonedx.ExternalReference{}
+		}
+		*externalRefs = append(*externalRefs, *srcRef)
+	}
+
 	return cyclonedx.Component{
 		Type:               componentType,
 		Name:               p.Name,
@@ -59,7 +67,7 @@ func EncodeComponent(p pkg.Package, supplier string, locationSorter func(a, b fi
 		Author:             encodeAuthor(p),
 		Publisher:          encodePublisher(p),
 		Description:        encodeDescription(p),
-		ExternalReferences: encodeExternalReferences(p),
+		ExternalReferences: externalRefs,
 		Properties:         properties,
 		BOMRef:             DeriveBomRef(p),
 	}
diff --git a/syft/format/internal/cyclonedxutil/helpers/external_references.go b/syft/format/internal/cyclonedxutil/helpers/external_references.go
index 54053d21f..5b6e8ec89 100644
--- a/syft/format/internal/cyclonedxutil/helpers/external_references.go
+++ b/syft/format/internal/cyclonedxutil/helpers/external_references.go
@@ -80,6 +80,7 @@ func encodeExternalReferences(p pkg.Package) *[]cyclonedx.ExternalReference {
 			}
 		}
 	}
+
 	if len(refs) > 0 {
 		return &refs
 	}