Ensure that all cyclonedx components have bom-refs (#914)

Co-authored-by: Alex Goodman <alex.goodman@anchore.com>

internal/formats/common/cyclonedxhelpers/component.go

@@ -5,6 +5,7 @@ import (
 
 	"github.com/CycloneDX/cyclonedx-go"
 
+	"github.com/anchore/packageurl-go"
 	"github.com/anchore/syft/internal/formats/common"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/source"
@@ -39,9 +40,23 @@ func encodeComponent(p pkg.Package) cyclonedx.Component {
 		Description:        encodeDescription(p),
 		ExternalReferences: encodeExternalReferences(p),
 		Properties:         properties,
+		BOMRef:             deriveBomRef(p),
 	}
 }
 
+func deriveBomRef(p pkg.Package) string {
+	// try and parse the PURL if possible and append syft id to it, to make
+	// the purl unique in the BOM.
+	// TODO: In the future we may want to dedupe by PURL and combine components with
+	// the same PURL while preserving their unique metadata.
+	if parsedPURL, err := packageurl.FromString(p.PURL); err == nil {
+		parsedPURL.Qualifiers = append(parsedPURL.Qualifiers, packageurl.Qualifier{Key: "syft-id", Value: string(p.ID())})
+		return parsedPURL.ToString()
+	}
+	// fallback is to use strictly the ID if there is no valid pURL
+	return string(p.ID())
+}
+
 func hasMetadata(p pkg.Package) bool {
 	return p.Metadata != nil
 }

internal/formats/common/cyclonedxhelpers/component_test.go

@@ -1,6 +1,7 @@
 package cyclonedxhelpers
 
 import (
+	"fmt"
 	"testing"
 
 	"github.com/CycloneDX/cyclonedx-go"
@@ -139,3 +140,54 @@ func Test_encodeComponentProperties(t *testing.T) {
 		})
 	}
 }
+
+func Test_deriveBomRef(t *testing.T) {
+	pkgWithPurl := pkg.Package{
+		Name:    "django",
+		Version: "1.11.1",
+		PURL:    "pkg:pypi/django@1.11.1",
+	}
+	pkgWithPurl.SetID()
+
+	pkgWithOutPurl := pkg.Package{
+		Name:    "django",
+		Version: "1.11.1",
+		PURL:    "",
+	}
+	pkgWithOutPurl.SetID()
+
+	pkgWithBadPurl := pkg.Package{
+		Name:    "django",
+		Version: "1.11.1",
+		PURL:    "pkg:pyjango@1.11.1",
+	}
+	pkgWithBadPurl.SetID()
+
+	tests := []struct {
+		name string
+		pkg  pkg.Package
+		want string
+	}{
+		{
+			name: "use pURL-id hybrid",
+			pkg:  pkgWithPurl,
+			want: fmt.Sprintf("pkg:pypi/django@1.11.1?syft-id=%s", pkgWithPurl.ID()),
+		},
+		{
+			name: "fallback to ID when pURL is invalid",
+			pkg:  pkgWithBadPurl,
+			want: string(pkgWithBadPurl.ID()),
+		},
+		{
+			name: "fallback to ID when pURL is missing",
+			pkg:  pkgWithOutPurl,
+			want: string(pkgWithOutPurl.ID()),
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			tt.pkg.ID()
+			assert.Equal(t, tt.want, deriveBomRef(tt.pkg))
+		})
+	}
+}

internal/formats/common/testutils/utils.go

@@ -169,7 +169,7 @@ func populateImageCatalog(catalog *pkg.Catalog, img *image.Image) {
 			Name:    "package-1",
 			Version: "1.0.1",
 		},
-		PURL: "a-purl-1",
+		PURL: "a-purl-1", // intentionally a bad pURL for test fixtures
 		CPEs: []pkg.CPE{
 			pkg.MustCPE("cpe:2.3:*:some:package:1:*:*:*:*:*:*:*"),
 		},
@@ -187,7 +187,7 @@ func populateImageCatalog(catalog *pkg.Catalog, img *image.Image) {
 			Package: "package-2",
 			Version: "2.0.1",
 		},
-		PURL: "a-purl-2",
+		PURL: "pkg:deb/debian/package-2@2.0.1",
 		CPEs: []pkg.CPE{
 			pkg.MustCPE("cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"),
 		},
@@ -249,7 +249,7 @@ func newDirectoryCatalog() *pkg.Catalog {
 				},
 			},
 		},
-		PURL: "a-purl-2",
+		PURL: "a-purl-2", // intentionally a bad pURL for test fixtures
 		CPEs: []pkg.CPE{
 			pkg.MustCPE("cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"),
 		},
@@ -267,7 +267,7 @@ func newDirectoryCatalog() *pkg.Catalog {
 			Package: "package-2",
 			Version: "2.0.1",
 		},
-		PURL: "a-purl-2",
+		PURL: "pkg:deb/debian/package-2@2.0.1",
 		CPEs: []pkg.CPE{
 			pkg.MustCPE("cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"),
 		},