fix: remove bom-refs only for deleted components in build public

CBeck-96 commented 1 month ago

closes #154

github-actions[bot] commented 1 month ago

Coverage Report •

File	Stmts	Miss	Cover	Missing
build_public_bom.py	63	0	100%
auxiliary
sbomFunctions.py	149	3	97%	68, 76, 153
TOTAL	1684	91	94%

Tests	Skipped	Failures	Errors	Time
297	2 :zzz:	0 :x:	0 :fire:	4.968s :stopwatch:

mmarseu commented 3 weeks ago

After including the compositions from #154, just for double-check, into my SBOM, where the bom-refs are not used for any component, I made the observation that you delete the bom-refs.

Looking at your code, you are using list_of_components to get your bom-refs and as they are not within the components of my SBOM you remove the bom-refs from #154 in composition. This is definitely a "plausibility check", not something I would expect from build-public. Therefore, please change this behavior.

Do you agree, @mmarseu? (Let's not talk about the irony that we just closed the PR #14 for plausibility check 😆)

Yes, I agree. build-public should strictly only delete bom-refs for deleted components

Festo-se / cyclonedx-editor-validator

fix: remove bom-refs only for deleted components in build public #196