Nested Components

[fnxpt]

Describe the bug

We noticed that nested components are being added with a | separated the parent component and the compontent.

cyclonedx-node-npm/src/builders.ts

Line 267 in 7ee7ee3

const fill = component.bomRef.value + '|'

Expected behavior

Components should be listed individually and the relation between them should be added on the dependencies node.

[jkowalleck]

Components should be listed individually and the relation between them should be added on the dependencies node.

how comes?

Please read the following:

• https://github.com/CycloneDX/cyclonedx-node-npm/blob/main/docs/nodejs_internals.md
• https://github.com/CycloneDX/cyclonedx-node-npm/blob/main/docs/result.md

After reading this, are you confident about your idea? Can you explain why?

[jkowalleck]

you are referring to a bom-ref that contains |? Is there something wrong with it?

[jkowalleck]

reply here: #617

[fnxpt]

Yes shouldn’t nested dependencies be marked individually and linked in the dependencies Sent from my iPhoneOn 30 Mar 2023, at 16:48, Jan Kowalleck ***@***.***> wrote: you are referring to a bom-ref that contains |? Is there something wrong with it? —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you authored the thread.Message ID: ***@***.***>

[jkowalleck]

are they not? could you show on one of the demos/examples?

[fnxpt]

https://github.com/CycloneDX/cyclonedx-node-npm/blob/main/demo/bundled-dependencies/example-results/bare/bom.1.4.json#L177

Shouldn't it be just the name of the component and then on the dependencies create the relationship between them

[fnxpt]

Just asking because this could lead to duplicates if this component is also inside other components

[jkowalleck]

Shouldn't it be just the name of the component [...]

how comes this idea?

[...] the dependencies create the relationship between them

is it not? see

cyclonedx-node-npm/demo/bundled-dependencies/example-results/bare/bom.1.4.json

Lines 2342 to 2346 in 3056b93

	"ref": "bundle-dependencies@1.0.2|is-builtin-module@1.0.0",
	"dependsOn": [
	"bundle-dependencies@1.0.2|builtin-modules@1.1.1"
	]
	},

---

Just asking because this could lead to duplicates if this component is also inside other components

you think so? could you craft a reproducible example setup and run this very tool on it to showcase this possibility?