Issue 966: Extend HasSBOM to include references to included software …

[knrc]

…(Package and Artifact), dependencies and occurrences

Description of the PR

Extends HasSBOM to include related packages/artifacts, dependencies and occurrences. Requires IDs to be sent for included nodes. Addresses #966, but still needs work done on backends other than inmem.

Consider this a work in progress for now

PR Checklist

• All commits have a Developer Certificate of Origin (DCO) -- they are generated using -s flag to git commit.
• All new changes are covered by tests
• If GraphQL schema is changed, make generate has been run
• If collectsub protobuf has been changed, make proto has been run
• All CI checks are passing (tests and formatting)
• All dependent PRs have already been merged

[knrc]

Note this PR needs discussion and further work so should not be merged at present

[knrc]

One question that needs answering relates to the edges used to identify Neighbors, as these are currently unidirectional (sbom -> PackageVersion/Artifact, IsDependency, IsOccurrence). Do we want those to be bidirectional? If so, how should we handle PackageVersion -> sbom?

[mrizzi]

Cherry-pick'd 890fe58 because other PRs failing and it would fix them without having to wait for this PR to get merged.

[knrc]

@pxp928 updated to use a flattened structure. There's also an additional commit for one e2e tests, it seemed to be non-deterministic in that the versions being diffed could be in different orders.

[pxp928]

Overall this looks great! Thanks @knrc for all the work on this!

[knrc]

@pxp928 @mihaimaruseac I've pushed the latest version, now also including the sbom includes in the filtering. I have also updated the source ingestion so it returns all IDs, rather than just the top level, non-specific ID.

I believe this is all the required functionality, let me know what you think and I can squash and remove the WIP tag if you are happy

[pxp928]

This looks good to me! Thanks for all the work on this!

[mihaimaruseac]

Looks great! Thank you

[knrc]

Thanks very much. I'll squash the PR into two commits, the first for these changes and the second for the small fix to the e2e test that's also in this PR.

[lumjjb]

Wanted to recall what the decision was around having the ID list vs having the ID be part of the DependencyInputSpec, OccurrenceInputSpec, etc. , else lgtm

[knrc]

Looks like I need to rebase again, I'll update to the latest main branch and push