cyclonedx-dotnet-library
cyclonedx-dotnet-library copied to clipboard
Flat merging can result in duplicate BOM refs
Not sure how to handle this. For hierarchical merging the top level component information can be used to "namespace" BOM refs.
Maybe requires supporting passing in namespace values for each BOM or optionally generating a random namespace.
I personally don't like the latter as it will drastically change BOM refs between runs. But maybe that's not really an issue given they are just used to identify elements within a single instance of a BOM.
This should be fixed with #199