add package infos as "externalReferences"

[jkowalleck]

see https://cyclonedx.org/use-cases/#external-references
caused: CycloneDX/cyclonedx-php-library#7
requires: https://github.com/CycloneDX/cyclonedx-php-library/releases/tag/v1.1.0

fetch these (optional) information from composer packages:
according to the CDX externalReferenceType:

• vcs
  • see "VCS" below
• issue-tracker
  • "issues" in https://getcomposer.org/doc/04-schema.md#support
• website
  • https://getcomposer.org/doc/04-schema.md#homepage
• advisories
  • maybe use packagist's buildin? what about alternative/private package repos - like packgist.com
• bom -
• mailing-list -
• social -
• chat
  • "chat" in https://getcomposer.org/doc/04-schema.md#support
  • "irc" in https://getcomposer.org/doc/04-schema.md#support
• [documentation
  • "docs" in https://getcomposer.org/doc/04-schema.md#support
  • "docs" in https://getcomposer.org/doc/04-schema.md#support
• support
  • any of the not already used ones from in https://getcomposer.org/doc/04-schema.md#support
• distribution
  • see "dist " below
  • "source" in https://getcomposer.org/doc/04-schema.md#support
• license -
• build-meta -
• build-system -
• other
  • funding: https://getcomposer.org/doc/04-schema.md#funding

VCS / dist

this one might be tricky, since it MUST reflect which actual package source was used. (dist- or source-package)
use the installation-source of the installed-lock (see #122) .

on the other hand it might be possible to simply add both sources as they might be in a lockfile.

example:

{
  "packages": [
    {
        "name": "swaggest/json-diff",
        "version": "v3.8.3",
        "version_normalized": "3.8.3.0",
        "source": {
            "type": "git",
            "url": "https://github.com/swaggest/json-diff.git",
            "reference": "bb3e3b4e9d842bb2e48f31ea568d0459968d1d42"
        },
        "dist": {
            "type": "zip",
            "url": "https://api.github.com/repos/swaggest/json-diff/zipball/bb3e3b4e9d842bb2e48f31ea568d0459968d1d42",
            "reference": "bb3e3b4e9d842bb2e48f31ea568d0459968d1d42",
            "shasum": ""
        },
        "require": {
            "ext-json": "*"
        },
        "require-dev": {
            "phpunit/phpunit": "^4.8.23"
        },
        "time": "2021-09-25T22:09:03+00:00",
        "type": "library",
        "installation-source": "dist"
    }
  ]
}

[jkowalleck]

RELATED: CycloneDX/specification#98

[jkowalleck]

also fetch these information for the project itself. see DependencyTrack/dependency-track#920