component's reference

[jkowalleck]

Is your feature request related to a problem? Please describe.

Currently, the component knows hashes that are based on composer's distribution hashes.
Nowadays, they are not used much. Instead, repository references are used - git node ids and so on.
These references should be in the BOM result.

see an example from some composer.lock file

{
            "name": "cyclonedx/cyclonedx-library",
            "version": "dev-master",
            "source": {
                "type": "git",
                "url": "https://github.com/CycloneDX/cyclonedx-php-library.git",
                "reference": "a2a854e03dbdeed5905ef7789a685b062941f5d2"
            },
            "dist": {
                "type": "zip",
                "url": "https://api.github.com/repos/CycloneDX/cyclonedx-php-library/zipball/a2a854e03dbdeed5905ef7789a685b062941f5d2",
                "reference": "a2a854e03dbdeed5905ef7789a685b062941f5d2",
                "shasum": ""
            },
}

Describe the solution you'd like

• component has a property for the source reference .
• component has a property for the dist reference .

register a property for https://github.com/CycloneDX/cyclonedx-property-taxonomy/blob/main/cdx/composer.md

Describe alternatives you've considered

none

Additional context

Add any other context or screenshots about the feature request here.

---

status:

• implementation Dist source reference #320
• finalize registration in the taxonomy: cdx:composer:package source/dist refenrence cyclonedx-property-taxonomy#44