I am not sure what fields comp_with_uniq_id is scoring

[aidankeefe2022]

I was removing parts of SBOMs and running them back through SBOMqs and comparing scores the comp_with_uniq_id never changed while all the others did for SPDX. I removed externalRefs and also removed SPDXID but the score did not change. I tried reading the score code but it seemed to support my idea that SPDXID and CPEs (stored in externalRefs?) were what the targets where. Where am I going wrong here?

[riteshnoronha]

A unique id for SPDX is the SPDXID of a component, along with the namespace of the document.

sbomqs/pkg/scorer/ntia.go

Line 102 in f95627d

return strings.Join([]string{d.Spec().Namespace(), c.ID()}, "")

➜  samples git:(main) sbomqs score -f comp_with_uniq_ids sbomqs-spdx-sbtool.json
featureScores()
SBOM Quality Score:10.0 components:70   sbomqs-spdx-sbtool.json
+-----------------------+--------------------+-----------+------------------------+
|       CATEGORY        |      FEATURE       |   SCORE   |          DESC          |
+-----------------------+--------------------+-----------+------------------------+
| NTIA-minimum-elements | comp_with_uniq_ids | 10.0/10.0 | 70/70 have unique ID's |
+-----------------------+--------------------+-----------+------------------------+

If you remove SPDXID of packages the count should drop. Below i removed SPDXID
from 3 components, you can see the unique ID dropped.

➜  samples git:(main) ✗ sbomqs score -f comp_with_uniq_ids sbomqs-spdx-sbtool.json
featureScores()
SBOM Quality Score:9.7  components:70   sbomqs-spdx-sbtool.json
+-----------------------+--------------------+----------+------------------------+
|       CATEGORY        |      FEATURE       |  SCORE   |          DESC          |
+-----------------------+--------------------+----------+------------------------+
| NTIA-minimum-elements | comp_with_uniq_ids | 9.7/10.0 | 68/70 have unique ID's |
+-----------------------+--------------------+----------+------------------------+

There is a off by one bug, which i will fix.

Does this answer your question ?

[aidankeefe2022]

It absolutely does thank you so much!