fix(sbom): ensure bom-ref uniqueness in cyclonedx@1.6 SBOM merge

go.mod

@@ -127,6 +127,7 @@ require (
 	github.com/moby/term v0.5.0 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/ohler55/ojg v1.26.7 // indirect
+	github.com/package-url/packageurl-go v0.1.5 // indirect
 	github.com/radovskyb/watcher v1.0.7 // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
 	github.com/sajari/fuzzy v1.0.0 // indirect

go.sum

@@ -1151,6 +1151,8 @@ github.com/otiai10/mint v1.3.0/go.mod h1:F5AjcsTsWUqX+Na9fpHb52P8pcRX2CI6A3ctIT9
 github.com/otiai10/mint v1.3.1/go.mod h1:/yxELlJQ0ufhjUwhshSj+wFjZ78CnZ48/1wtmBH1OTc=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
 github.com/otiai10/mint v1.6.3/go.mod h1:MJm72SBthJjz8qhefc4z1PYEieWmy8Bku7CjcAqyUSM=
+github.com/package-url/packageurl-go v0.1.5 h1:O4efRXja2XQ5CtiiYiCZ22k/m7i5ugLiAghgcC+eDgk=
+github.com/package-url/packageurl-go v0.1.5/go.mod h1:nKAWB8E6uk1MHqiS/lQb9pYBGH2+mdJ2PJc2s50dQY0=
 github.com/pact-foundation/pact-go v1.0.4/go.mod h1:uExwJY4kCzNPcHRj+hCR/HBbOOIwwtUjcrb0b5/5kLM=
 github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
 github.com/pborman/uuid v1.2.0/go.mod h1:X/NO0urCmaxf9VXbdlT7C2Yzkj2IKimNn4k+gtPdI/k=

pkg/sbom/cyclonedxutil/bomref.go

@@ -0,0 +1,185 @@
+package cyclonedxutil
+
+import (
+	"crypto/sha256"
+	"fmt"
+
+	cdx "github.com/CycloneDX/cyclonedx-go"
+	packageurl "github.com/package-url/packageurl-go"
+)
+
+func packageID(serial string, index int) string {
+	h := sha256.Sum256([]byte(fmt.Sprintf("%s:%d", serial, index)))
+	return fmt.Sprintf("%x", h[:8])
+}
+
+func deriveBomRef(purl, serial string, index int) string {
+	id := packageID(serial, index)
+
+	parsed, err := packageurl.FromString(purl)
+	if err != nil {
+		return id
+	}
+
+	parsed.Qualifiers = append(parsed.Qualifiers, packageurl.Qualifier{
+		Key:   "package-id",
+		Value: id,
+	})
+
+	return parsed.ToString()
+}
+
+func assignNewRef(oldRef, purl, serial string, index int, refMap map[string]string) string {
+	newRef := deriveBomRef(purl, serial, index)
+	if oldRef != newRef {
+		refMap[oldRef] = newRef
+	}
+
+	return newRef
+}
+
+func ensureUniqueBOMRefs(bom *cdx.BOM) {
+	if bom == nil {
+		return
+	}
+
+	refMap := map[string]string{}
+	serial := bom.SerialNumber
+	index := 0
+
+	if bom.Components != nil {
+		comps := *bom.Components
+		for i := range comps {
+			if comps[i].BOMRef != "" {
+				comps[i].BOMRef = assignNewRef(comps[i].BOMRef, comps[i].PackageURL, serial, index, refMap)
+			}
+			index++
+		}
+	}
+
+	if bom.Services != nil {
+		svcs := *bom.Services
+		for i := range svcs {
+			if svcs[i].BOMRef != "" {
+				svcs[i].BOMRef = assignNewRef(svcs[i].BOMRef, "", serial, index, refMap)
+			}
+			index++
+		}
+	}
+
+	rewriteAllRefs(bom, refMap)
+}
+
+func remapRef(ref string, refMap map[string]string) string {
+	if newRef, ok := refMap[ref]; ok {
+		return newRef
+	}
+
+	return ref
+}
+
+func remapStringSlice(ss *[]string, refMap map[string]string) {
+	if ss == nil {
+		return
+	}
+
+	for i := range *ss {
+		(*ss)[i] = remapRef((*ss)[i], refMap)
+	}
+}
+
+func remapBOMReferenceSlice(refs *[]cdx.BOMReference, refMap map[string]string) {
+	if refs == nil {
+		return
+	}
+
+	for i := range *refs {
+		(*refs)[i] = cdx.BOMReference(remapRef(string((*refs)[i]), refMap))
+	}
+}
+
+func rewriteAllRefs(bom *cdx.BOM, refMap map[string]string) {
+	if len(refMap) == 0 {
+		return
+	}
+
+	rewriteDependencyRefs(bom.Dependencies, refMap)
+	rewriteVulnerabilityRefs(bom.Vulnerabilities, refMap)
+	rewriteCompositionRefs(bom.Compositions, refMap)
+	rewriteAnnotationRefs(bom.Annotations, refMap)
+	rewriteDeclarationRefs(bom.Declarations, refMap)
+}
+
+func rewriteDependencyRefs(deps *[]cdx.Dependency, refMap map[string]string) {
+	if deps == nil {
+		return
+	}
+
+	for i := range *deps {
+		(*deps)[i].Ref = remapRef((*deps)[i].Ref, refMap)
+		remapStringSlice((*deps)[i].Dependencies, refMap)
+		remapStringSlice((*deps)[i].Provides, refMap)
+	}
+}
+
+func rewriteVulnerabilityRefs(vulns *[]cdx.Vulnerability, refMap map[string]string) {
+	if vulns == nil {
+		return
+	}
+
+	for i := range *vulns {
+		if (*vulns)[i].Affects == nil {
+			continue
+		}
+
+		for j := range *(*vulns)[i].Affects {
+			(*(*vulns)[i].Affects)[j].Ref = remapRef((*(*vulns)[i].Affects)[j].Ref, refMap)
+		}
+	}
+}
+
+func rewriteCompositionRefs(compositions *[]cdx.Composition, refMap map[string]string) {
+	if compositions == nil {
+		return
+	}
+
+	for i := range *compositions {
+		remapBOMReferenceSlice((*compositions)[i].Assemblies, refMap)
+		remapBOMReferenceSlice((*compositions)[i].Dependencies, refMap)
+		remapBOMReferenceSlice((*compositions)[i].Vulnerabilities, refMap)
+	}
+}
+
+func rewriteAnnotationRefs(annotations *[]cdx.Annotation, refMap map[string]string) {
+	if annotations == nil {
+		return
+	}
+
+	for i := range *annotations {
+		remapBOMReferenceSlice((*annotations)[i].Subjects, refMap)
+	}
+}
+
+func rewriteDeclarationRefs(declarations *cdx.Declarations, refMap map[string]string) {
+	if declarations == nil {
+		return
+	}
+
+	if declarations.Assessors != nil {
+		for i := range *declarations.Assessors {
+			(*declarations.Assessors)[i].BOMRef = cdx.BOMReference(remapRef(string((*declarations.Assessors)[i].BOMRef), refMap))
+		}
+	}
+
+	if declarations.Claims != nil {
+		for i := range *declarations.Claims {
+			(*declarations.Claims)[i].BOMRef = remapRef((*declarations.Claims)[i].BOMRef, refMap)
+		}
+	}
+
+	if declarations.Evidence != nil {
+		for i := range *declarations.Evidence {
+			(*declarations.Evidence)[i].BOMRef = remapRef((*declarations.Evidence)[i].BOMRef, refMap)
+		}
+	}
+}