feat(sbom): keep internal uuid to identify components

pkg/fanal/types/artifact.go

@@ -4,6 +4,8 @@ import (
 	"time"
 
 	"github.com/samber/lo"
+
+	"github.com/aquasecurity/trivy/pkg/uuid"
 )
 
 type OS struct {
@@ -13,6 +15,10 @@ type OS struct {
 
 	// This field is used for enhanced security maintenance programs such as Ubuntu ESM, Debian Extended LTS.
 	Extended bool `json:"extended,omitempty"`
+
+	// ComponentID is used for internal representation of the SBOM component.
+	// It is not exported to the JSON output.
+	ComponentID uuid.UUID `json:"-"`
 }
 
 func (o *OS) Detected() bool {
@@ -72,6 +78,10 @@ type Application struct {
 
 	// Packages is a list of lang-specific packages
 	Packages Packages
+
+	// ComponentID is used for internal representation of the SBOM component.
+	// It is not exported to the JSON output.
+	ComponentID uuid.UUID `json:"-"`
 }
 
 type File struct {

pkg/fanal/types/package.go

@@ -9,6 +9,7 @@ import (
 	"golang.org/x/xerrors"
 
 	"github.com/aquasecurity/trivy/pkg/digest"
+	"github.com/aquasecurity/trivy/pkg/uuid"
 )
 
 type Relationship int
@@ -213,6 +214,10 @@ type Package struct {
 
 	// Files installed by the package
 	InstalledFiles []string `json:",omitempty"`
+
+	// ComponentID is used for internal representation of the SBOM component.
+	// It is not exported to the JSON output.
+	ComponentID uuid.UUID `json:"-"`
 }
 
 func (pkg *Package) Empty() bool {

pkg/sbom/core/bom.go

@@ -290,6 +290,17 @@ func (b *BOM) Root() *Component {
 	return root
 }
 
+func (b *BOM) Component(id uuid.UUID) *Component {
+	c, ok := b.components[id]
+	if !ok {
+		return nil
+	}
+	if b.opts.GenerateBOMRef && c.PkgIdentifier.BOMRef == "" {
+		c.PkgIdentifier.BOMRef = b.bomRef(c)
+	}
+	return c
+}
+
 func (b *BOM) Components() map[uuid.UUID]*Component {
 	// Fill in BOMRefs for components
 	if b.opts.GenerateBOMRef {

pkg/sbom/io/decode.go

@@ -124,8 +124,9 @@ func (m *Decoder) decodeComponents(ctx context.Context, sbom *types.SBOM) error
 			}
 			m.osID = id
 			sbom.Metadata.OS = &ftypes.OS{
-				Family: ftypes.OSType(c.Name),
-				Name:   c.Version,
+				Family:      ftypes.OSType(c.Name),
+				Name:        c.Version,
+				ComponentID: id,
 			}
 			continue
 		case core.TypeApplication:
@@ -169,7 +170,9 @@ func (m *Decoder) buildDependencyGraph() {
 }
 
 func (m *Decoder) decodeApplication(c *core.Component) *ftypes.Application {
-	var app ftypes.Application
+	app := ftypes.Application{
+		ComponentID: c.ID(),
+	}
 	for _, prop := range c.Properties {
 		if prop.Name == core.PropertyType {
 			app.Type = ftypes.LangType(prop.Value)
@@ -229,6 +232,7 @@ func (m *Decoder) decodePackage(ctx context.Context, c *core.Component) (*ftypes
 
 	pkg.Identifier.BOMRef = c.PkgIdentifier.BOMRef
 	pkg.Licenses = c.Licenses
+	pkg.ComponentID = c.ID()
 
 	for _, f := range c.Files {
 		if f.Path != "" && pkg.FilePath == "" {

pkg/sbom/io/encode.go

@@ -1,11 +1,11 @@
 package io
 
 import (
+	"cmp"
 	"fmt"
 	"slices"
 	"strconv"
 
-	"github.com/google/uuid"
 	"github.com/package-url/packageurl-go"
 	"github.com/samber/lo"
 	"golang.org/x/xerrors"
@@ -20,19 +20,20 @@ import (
 )
 
 type Encoder struct {
-	bom        *core.BOM
-	opts       core.Options
-	components map[uuid.UUID]*core.Component
+	bom  *core.BOM
+	opts core.Options
+
+	// Hold the original SBOM when we scan SBOM file.
+	original *core.BOM
 }
 
 func NewEncoder(opts core.Options) *Encoder {
 	return &Encoder{opts: opts}
 }
 
 func (e *Encoder) Encode(report types.Report) (*core.BOM, error) {
-	if report.BOM != nil {
-		e.components = report.BOM.Components()
-	}
+	e.original = cmp.Or(report.BOM, core.NewBOM(core.Options{})) // Set an empty BOM to avoid panic if the original BOM is nil
+
 	// Metadata component
 	root, err := e.rootComponent(report)
 	if err != nil {
@@ -104,8 +105,8 @@ func (e *Encoder) rootComponent(r types.Report) (*core.Component, error) {
 	case artifact.TypeCycloneDX, artifact.TypeSPDX:
 		// When we scan SBOM file
 		// If SBOM file doesn't contain root component - use filesystem
-		if r.BOM != nil && r.BOM.Root() != nil {
-			return r.BOM.Root(), nil
+		if rt := e.original.Root(); rt != nil {
+			return rt, nil
 		}
 		// When we scan a `json` file (meaning a file in `json` format) which was created from the SBOM file.
 		// e.g. for use in `convert` mode.
@@ -262,17 +263,11 @@ func (e *Encoder) encodePackages(parent *core.Component, result types.Result) {
 	}
 }
 
-// existedPkgIdentifier tries to look for package identifier (BOM-ref, PURL) by component name and component type
-func (e *Encoder) existedPkgIdentifier(name string, componentType core.ComponentType) ftypes.PkgIdentifier {
-	for _, c := range e.components {
-		if c.Name == name && c.Type == componentType {
-			return c.PkgIdentifier
-		}
+func (e *Encoder) resultComponent(root *core.Component, r types.Result, osFound *ftypes.OS) *core.Component {
+	if c := e.original.Component(r.ComponentID); c != nil {
+		return c // Return the original component if it exists
 	}
-	return ftypes.PkgIdentifier{}
-}
 
-func (e *Encoder) resultComponent(root *core.Component, r types.Result, osFound *ftypes.OS) *core.Component {
 	component := &core.Component{
 		Name: r.Target,
 		Properties: []core.Property{
@@ -294,17 +289,19 @@ func (e *Encoder) resultComponent(root *core.Component, r types.Result, osFound
 			component.Version = osFound.Name
 		}
 		component.Type = core.TypeOS
-		component.PkgIdentifier = e.existedPkgIdentifier(component.Name, component.Type)
 	case types.ClassLangPkg:
 		component.Type = core.TypeApplication
-		component.PkgIdentifier = e.existedPkgIdentifier(component.Name, component.Type)
 	}
 
 	e.bom.AddRelationship(root, component, core.RelationshipContains)
 	return component
 }
 
-func (*Encoder) component(result types.Result, pkg ftypes.Package) *core.Component {
+func (e *Encoder) component(result types.Result, pkg ftypes.Package) *core.Component {
+	if c := e.original.Component(pkg.ComponentID); c != nil {
+		return c // Return the original component if it exists
+	}
+
 	name := pkg.Name
 	version := utils.FormatVersion(pkg)
 	var group string

pkg/scanner/langpkg/scan.go

@@ -49,9 +49,10 @@ func (s *scanner) Scan(ctx context.Context, target types.ScanTarget, opts types.
 
 		ctx = log.WithContextPrefix(ctx, string(app.Type))
 		result := types.Result{
-			Target: targetName(app.Type, app.FilePath),
-			Class:  types.ClassLangPkg,
-			Type:   app.Type,
+			Target:      targetName(app.Type, app.FilePath),
+			Class:       types.ClassLangPkg,
+			Type:        app.Type,
+			ComponentID: app.ComponentID,
 		}
 
 		sort.Sort(app.Packages)

pkg/scanner/ospkg/scan.go

@@ -37,9 +37,10 @@ func (s *scanner) Scan(ctx context.Context, target types.ScanTarget, opts types.
 	}
 
 	result := types.Result{
-		Target: fmt.Sprintf("%s (%s %s)", target.Name, target.OS.Family, target.OS.Name),
-		Class:  types.ClassOSPkg,
-		Type:   target.OS.Family,
+		Target:      fmt.Sprintf("%s (%s %s)", target.Name, target.OS.Family, target.OS.Name),
+		Class:       types.ClassOSPkg,
+		Type:        target.OS.Family,
+		ComponentID: target.OS.ComponentID,
 	}
 
 	sort.Sort(target.Packages)

pkg/types/report.go

@@ -8,6 +8,7 @@ import (
 	"github.com/aquasecurity/trivy/pkg/fanal/artifact"
 	ftypes "github.com/aquasecurity/trivy/pkg/fanal/types"
 	"github.com/aquasecurity/trivy/pkg/sbom/core"
+	"github.com/aquasecurity/trivy/pkg/uuid"
 )
 
 // Report represents a scan result
@@ -122,6 +123,10 @@ type Result struct {
 	// This can include vulnerabilities that have been marked as ignored, not affected, or have had
 	// their severity adjusted. It's still in an experimental stage and may change in the future.
 	ModifiedFindings []ModifiedFinding `json:"ExperimentalModifiedFindings,omitempty"`
+
+	// ComponentID is used for internal representation of the SBOM component.
+	// It is not exported to the JSON output.
+	ComponentID uuid.UUID `json:"-"`
 }
 
 func (r *Result) IsEmpty() bool {