bug(cyclonedx): wrong purl for local Go dependencies

[DmitriyLewen]

Discussed in #5434

We don't create PURL for local Go dependencies, but still create CycloneDX component:

 "bom-ref": "pkg:/",
      "type": "library",
      "name": "./api",
      "purl": "pkg:/",
      "properties": [
...

  "dependencies": [
    {
      "ref": "03a5f5e8-87ca-4f07-9309-c5de465ce1a8",
      "dependsOn": [
        "pkg:/",
...

[knqyf263]

@DmitriyLewen We should include local dependencies. In case we cannot generate PURL, we should use UUID.

This relies on a components bom-ref to associate the component to the dependency element in the graph. The only requirement for bom-ref is that it is unique within the BOM. Package URL (PURL) is an ideal choice for bom-ref as it will be both unique and readable. If PURL is not an option or not all components represented in the BOM contain a PURL, then UUID is recommended.

https://cyclonedx.org/use-cases/#dependency-graph

[MPV]

After the fix in #5448 I am now instead getting:

"message": "invalid package url: in manifest \"gobinary\" decoding \"\": scheme is missing",

[DmitriyLewen]

Hello @MPV
Can you give more information about your case, please?

[MPV]

Can you give more information about your case, please?

Yes, see:

• GitHub Dependency Graph fails on gobinary #5474

[DmitriyLewen]

Hello @MPV
Looks like this is GitHub bug.

But It is strange. We don't fill purl field for local Go dependencies:

    {
      "name": "./api",
      "SPDXID": "SPDXRef-Package-cab1689fa6aee0c7",
      "versionInfo": "(devel)",
      "supplier": "NOASSERTION",
      "downloadLocation": "NONE",
      "licenseConcluded": "NONE",
      "licenseDeclared": "NONE",
      "copyrightText": "",
      "primaryPackagePurpose": "LIBRARY"
    },

GitHub docs say that file must follow SPDX format - https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/exporting-a-software-bill-of-materials-for-your-repository
But externalRefs (field with purl) is not required field - https://spdx.github.io/spdx-spec/v2.3/package-information/#721-external-reference-field.