Provide option to include vcs url in the output bom file

[minato7]

Hi @prabhu, thank you for providing a great tool which supports generating SBOM for multiple languages which is helping us a lot.
Normally for a Golang project, cdxgen produces following information for a single component:

    <component type="library" bom-ref="pkg:golang/github.com/fsnotify/[email protected]">
      <publisher />
      <group>github.com/fsnotify</group>
      <name>fsnotify</name>
      <version>v1.6.0</version>
      <description />
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">b25dedd6d0962455a8473f51f162426d08a128ac26a2b8c06d20a5727c4a006c</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://pkg.go.dev/github.com/fsnotify/fsnotify?tab=licenses</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/fsnotify/[email protected]</purl>
    </component>

But additionally, it would be helpful for the user to have url of source repository for the package similar to cyclonedx-gomod
Sample output from cyclonedx-gomod for the same component:

    <component bom-ref="pkg:golang/github.com/fsnotify/[email protected]?type=module" type="library">
      <name>github.com/fsnotify/fsnotify</name>
      <version>v1.6.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">9fee56aae1b47dc5a85a9eb13d67c775bb2430241a1671ba3df06b8752b2e076</hash>
      </hashes>
      <purl>pkg:golang/github.com/fsnotify/[email protected]?type=module</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/fsnotify/fsnotify</url>
        </reference>
      </externalReferences>
    </component>

Is there a way to provide vcs url in cdxgen for multiple projects (Debian packages, golang, .NET)?

[prabhu]

@minato7 Could you try running cdxgen with the env variable FETCH_LICENSE=true?

[minato7]

@prabhu Yes, I have already generated xml with FETCH_LICENSE=true. It provides only this additional information:

      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://pkg.go.dev/github.com/fsnotify/fsnotify?tab=licenses</url>
        </license>
      </licenses>

which itself is not a vcs url.

[prabhu]

cool. I see the issue. Thank you for reporting!

[minato7]

Thank you for acknowledging it. Will this be fixed in subsequent releases? Can I track it somehow?

[prabhu]

Absolutely! Can't wait to fix this!

[setchy]

shall we convert this to a feature request issue @prabhu ?