Retain multiple SrcFile and identity evidences

[prabhu]

When a component is found under multiple manifests, cdxgen will try to retain all the locations under SrcFile and evidence.identity.

{
            "group": "google",
            "name": "auth",
            "version": "v1.42.0",
            "description": "Google Auth Library for PHP",
            "scope": "required",
            "licenses": [
                {
                    "license": {
                        "id": "Apache-2.0",
                        "url": "https://opensource.org/licenses/Apache-2.0"
                    }
                }
            ],
            "purl": "pkg:composer/google/[email protected]",
            "externalReferences": [
                {
                    "type": "vcs",
                    "url": "https://github.com/googleapis/google-auth-library-php.git"
                },
                {
                    "type": "distribution",
                    "url": "https://api.github.com/repos/googleapis/google-auth-library-php/zipball/0c25599a91530b5847f129b271c536f75a7563f5"
                }
            ],
            "type": "library",
            "bom-ref": "pkg:composer/google/[email protected]",
            "evidence": {
                "identity": [
                    {
                        "field": "purl",
                        "confidence": 1,
                        "methods": [
                            {
                                "technique": "manifest-analysis",
                                "confidence": 1,
                                "value": "/Volumes/Work/sandbox/php-project/Vacancy/composer.lock"
                            },
                            {
                                "technique": "manifest-analysis",
                                "confidence": 1,
                                "value": "/Volumes/Work/sandbox/php-project/Services/composer.lock"
                            },
                            {
                                "technique": "manifest-analysis",
                                "confidence": 1,
                                "value": "/Volumes/Work/sandbox/php-project/Scripts/composer.lock"
                            },
                            {
                                "technique": "manifest-analysis",
                                "confidence": 1,
                                "value": "/Volumes/Work/sandbox/php-project/Entrata/composer.lock"
                            },
                            {
                                "technique": "manifest-analysis",
                                "confidence": 1,
                                "value": "/Volumes/Work/sandbox/php-project/ClientAdmin/composer.lock"
                            }
                        ]
                    }
                ]
            },
            "tags": [
                "Authentication",
                "auth",
                "google",
                "oauth2"
            ],
            "properties": [
                {
                    "name": "SrcFile",
                    "value": "/Volumes/Work/sandbox/php-project/Vacancy/composer.lock"
                },
                {
                    "name": "Namespaces",
                    "value": "Google\\Auth\\"
                },
                {
                    "name": "SrcFile",
                    "value": "/Volumes/Work/sandbox/php-project/Services/composer.lock"
                },
                {
                    "name": "SrcFile",
                    "value": "/Volumes/Work/sandbox/php-project/Scripts/composer.lock"
                },
                {
                    "name": "SrcFile",
                    "value": "/Volumes/Work/sandbox/php-project/Entrata/composer.lock"
                },
                {
                    "name": "SrcFile",
                    "value": "/Volumes/Work/sandbox/php-project/ClientAdmin/composer.lock"
                }
            ]
        }

Might work generically, but tested only with php so far.

[readonlyuser1]

cdxgen --output sbom.json --recurse --with-deep-jar-collector false --validate --exclude Dockerfile --exclude-type gradle --exclude-type sbt --exclude **/{lib,libs,CopyLibs}/*.jar --timeout-ms 360000 --spec-version 1.5 --required-only --include-formulation

Found 145 jar packages at .
Obtained 163 components and 143 dependencies after dedupe.
Schema validation failed for APLICATIONCommon
[
  {
    instancePath: '/components/0/evidence/identity',
    schemaPath: '#/properties/identity/type',
    keyword: 'type',
    params: { type: 'object' },
    message: 'must be object',
    schema: 'object',
    parentSchema: {
      type: 'object',
      description: 'Evidence that substantiates the identity of a component.',
      required: [Array],
      additionalProperties: false,
      properties: [Object]
    },
    data: [ [Object] ]
  }
]

sbom-utility validate --input-file sbom.json

Welcome to the sbom-utility! Version `v0.17.0` (sbom-utility) (linux/amd64)
===========================================================================
[INFO] Loading (embedded) default schema config file: `config.json`...
[INFO] Loading (embedded) default license policy file: `license.json`...
[INFO] Attempting to load and unmarshal data from: `sbom.json`...
[INFO] Successfully unmarshalled data from: `sbom.json`
[INFO] Determining file's BOM format and version...
[INFO] Determined BOM format, version (variant): `CycloneDX`, `1.5` (latest)
[INFO] Matching BOM schema (for validation): schema/cyclonedx/1.5/bom-1.5.schema.json
[INFO] Loading schema `schema/cyclonedx/1.5/bom-1.5.schema.json`...
[INFO] Schema `schema/cyclonedx/1.5/bom-1.5.schema.json` loaded.
[INFO] Validating `sbom.json`...
[INFO] BOM valid against JSON schema: `false`
[INFO] (124) schema errors detected.
[INFO] Formatting error results (`txt` format)...
[INFO] Too many errors. Showing (10/124) errors.
1. {
        "type": "invalid_type",
        "field": "components.2.evidence.identity",
        "context": "(root).components.2.evidence.identity",
        "description": "Invalid type. Expected: object, given: array",
        "value": [
            {
                "confidence": 0.5,
                "field": "purl",
                "methods": [
                    {
                        "confidence": 0.5,
                        "technique": "filename",
                        "value": "antlr-2.7.2.jar"
                    },
                    {
                        "confidence": 0.5,
                        "technique": "manifest-analysis",
                        "value": "/builds/bbb/ck/pom.xml"
                    },
                    {
                        "confidence": 0.5,
                        "technique": "manifest-analysis",
                        "value": "/builds/bbb/ck/APLICATION/pom.xml"
                    },
                    {
                        "confidence": 0.5,
                        "technique": "manifest-analysis",
                        "value": "/builds/bbb/ck/APLICATIONAAA/pom.xml"
                    },
                    {
                        "confidence": 0.5,
                        "technique": "manifest-analysis",
                        "value": "/builds/bbb/ck/APLICATIONAAACommonLib/pom.xml"
                    },
                    {
                        "confidence": 0.5,
                        "technique": "manifest-analysis",
                        "value": "/builds/bbb/ck/APLICATIONGG2Lib/pom.xml"
                    },
                    {
                        "confidence": 0.5,
                        "technique": "manifest-analysis",
                        "value": "/builds/bbb/ck/wsGatewayBBBValidation/pom.xml"
                    },
                    {
                        "confidence": 0.5,
                        "technique": "manifest-analysis",
                        "value": "/builds/bbb/ck/wsGatewaySSS/pom.xml"
                    },
                    {
                        "confidence": 0.5,
                        "technique": "manifest-analysis",
                        "value": "/builds/bbb/ck/wsGatewayPP/pom.xml"
                    },
                    {
                        "confidence": 0.5,
                        "technique": "manifest-analysis",
                        "value": "/builds/bbb/ck/wsGatewayPP_M/pom.xml"
                    }
                ]
            }
        ]
    }
2. {
        "type": "invalid_type",
        "field": "components.5.evidence.identity",
        "context": "(root).components.5.evidence.identity",
        "description": "Invalid type. Expected: object, given: array",
        "value": [
            {
                "confidence": 0.5,
                "field": "purl",
                "methods": [
                    {
                        "confidence": 0.5,
                        "technique": "manifest-analysis",
                        "value": "/builds/bbb/ck/APLICATION/pom.xml"
                    },
                    {
                        "confidence": 1,
                        "technique": "manifest-analysis",
                        "value": "liquibase-migration-1.0.jar"
                    }
                ]
            }
        ]
    }
3. {
        "type": "invalid_type",
        "field": "components.6.evidence.identity",
        "context": "(root).components.6.evidence.identity",
        "description": "Invalid type. Expected: object, given: array",
        "value": [
            {
                "confidence": 0.5,
                "field": "purl",
                "methods": [
                    {
                        "confidence": 0.5,
                        "technique": "manifest-analysis",
                        "value": "/builds/bbb/ck/pom.xml"
                    },
                    {
                        "confidence": 0.5,
                        "technique": "manifest-analysis",
                        "value": "/builds/bbb/ck/APLICATION/pom.xml"
                    },
                    {
                        "confidence": 0.5,
                        "technique": "manifest-analysis",
                        "value": "/builds/bbb/ck/APLICATIONAAA/pom.xml"
                    },
                    {
                        "confidence": 0.5,
                        "technique": "manifest-analysis",
                        "value": "/builds/bbb/ck/wsGatewaySSS/pom.xml"
                    },
                    {
                        "confidence": 1,
                        "technique": "manifest-analysis",
                        "value": "printFormAspose-1.0.jar"
                    }
                ]
            }
        ]
    }

[prabhu]

Needs some triaging. evidence.identity is an object in 1.5 but array in 1.6. We have a logic that can fix/downgrade for 1.5. Need to check why this flow isn't working.

Can you investigate and send a PR?

[prabhu]

@readonlyuser1 do you have a test case to replicate this issue?