fix(sbom): correctly handle multiple vendors (second try)

Correctly handle multiple vendors by using set_relationship_id

Signed-off-by: Fabrice Fontaine <[email protected]>

cve_bin_tool/sbom_manager/generate.py

@@ -62,37 +62,54 @@ def generate_sbom(self) -> None:
         my_package.set_supplier("UNKNOWN", "NOASSERTION")
 
         # Store package data
-        self.sbom_packages[(my_package.get_name(), my_package.get_value("version"))] = (
-            my_package.get_package()
-        )
+        self.sbom_packages[
+            (
+                my_package.get_name(),
+                my_package.get_value("supplier"),
+                my_package.get_value("version"),
+            )
+        ] = my_package.get_package()
         sbom_relationship.initialise()
         sbom_relationship.set_relationship(parent, "DESCRIBES", root_package)
         sbom_relationships.append(sbom_relationship.get_relationship())
 
         # Add dependent products
+        product_number = 1
         for product_data in self.all_product_data:
+            product_number = product_number + 1
             my_package.initialise()
             my_package.set_name(product_data.product)
+            package_id = f"{product_number}-{product_data.product}"
+            my_package.set_id(package_id)
             my_package.set_version(product_data.version)
             if product_data.vendor.casefold() != "UNKNOWN".casefold():
                 my_package.set_supplier("Organization", product_data.vendor)
             my_package.set_licensedeclared(license)
             my_package.set_licenseconcluded(license)
             if not (
-                (my_package.get_name(), my_package.get_value("version"))
+                (
+                    my_package.get_name(),
+                    my_package.get_value("supplier"),
+                    my_package.get_value("version"),
+                )
                 in self.sbom_packages
                 and product_data.vendor == "unknown"
             ):
                 if self.all_cve_data.get(product_data):
                     for path in self.all_cve_data[product_data]["paths"]:
                         my_package.set_evidence(path)
                 self.sbom_packages[
-                    (my_package.get_name(), my_package.get_value("version"))
+                    (
+                        my_package.get_name(),
+                        my_package.get_value("supplier"),
+                        my_package.get_value("version"),
+                    )
                 ] = my_package.get_package()
             sbom_relationship.initialise()
             sbom_relationship.set_relationship(
                 root_package, "DEPENDS_ON", product_data.product
             )
+            sbom_relationship.set_relationship_id(None, package_id)
             sbom_relationships.append(sbom_relationship.get_relationship())
 
         # Generate SBOM