Following #444 and #485 and a discussion with @pombredanne:
we do track package instances correctly in case of scan-codebase pipeline and create separate instances for the same package correctly. But in d2d pipeline, for example while we are creating packages from purldb, even if there are same instances of a package in the codebase, we create only one package for a purl, and assign all the files from all instances there. This should be different instances to be correct.
We also need a way to provide UI/Outputs support such as:
- We know this is the same package
- But these are seperate instances present in seperate locations
So we need to provide this info in the outputs too (note that CycloneDx does not support dupes in packages, maybe we have to use a uuid qualifier like in SCTK) and in UI for packages table maybe we can have a tree-like structure to show purls and their respective package instances.
Following #444 and #485 and a discussion with @pombredanne:
we do track package instances correctly in case of scan-codebase pipeline and create separate instances for the same package correctly. But in d2d pipeline, for example while we are creating packages from purldb, even if there are same instances of a package in the codebase, we create only one package for a purl, and assign all the files from all instances there. This should be different instances to be correct.
We also need a way to provide UI/Outputs support such as:
So we need to provide this info in the outputs too (note that CycloneDx does not support dupes in packages, maybe we have to use a uuid qualifier like in SCTK) and in UI for packages table maybe we can have a tree-like structure to show purls and their respective package instances.