fix: place root component only in metadata.component, not in components[]

Per CycloneDX spec, the root component belongs in metadata.component only.
Previously it was duplicated in the components[] array, causing SBOM
parity issues between Java and JavaScript clients.

- Remove root component addition from addRoot()
- Update addDependency() to skip adding root as a component
- Update all 70 expected SBOM test fixtures to reflect the change

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: ruromero

src/main/java/io/github/guacsec/trustifyda/sbom/CycloneDXSbom.java

@@ -136,7 +136,6 @@ public Sbom addRoot(PackageURL rootRef, String license) {
       }
     }
     bom.getMetadata().setComponent(rootComponent);
-    bom.getComponents().add(rootComponent);
     bom.getDependencies().add(newDependency(rootRef));
     return this;
   }
@@ -266,13 +265,12 @@ public Sbom addDependency(PackageURL sourceRef, PackageURL targetRef, String s)
     if (s != null) {
       scope = Component.Scope.valueOf(s.toUpperCase());
     }
+    String rootCoordinates = root != null ? root.getCoordinates() : null;
     Component srcComp = newComponent(sourceRef, scope);
+    boolean isRootSource = srcComp.getBomRef().equals(rootCoordinates);
     Dependency srcDep;
-    if (bom.getComponents().stream().noneMatch(c -> c.getBomRef().equals(srcComp.getBomRef()))) {
-      bom.addComponent(srcComp);
-      srcDep = newDependency(sourceRef);
-      bom.addDependency(srcDep);
-    } else {
+    if (isRootSource
+        || bom.getComponents().stream().anyMatch(c -> c.getBomRef().equals(srcComp.getBomRef()))) {
       Optional<Dependency> existingDep =
           bom.getDependencies().stream()
               .filter(d -> d.getRef().equals(srcComp.getBomRef()))
@@ -283,13 +281,18 @@ public Sbom addDependency(PackageURL sourceRef, PackageURL targetRef, String s)
         srcDep = newDependency(sourceRef);
         bom.addDependency(srcDep);
       }
+    } else {
+      bom.addComponent(srcComp);
+      srcDep = newDependency(sourceRef);
+      bom.addDependency(srcDep);
     }
     Dependency targetDep = newDependency(targetRef);
     srcDep.addDependency(targetDep);
     if (bom.getDependencies().stream().noneMatch(d -> d.getRef().equals(targetDep.getRef()))) {
       bom.addDependency(targetDep);
     }
-    if (bom.getComponents().stream().noneMatch(c -> c.getBomRef().equals(targetDep.getRef()))) {
+    if (!targetDep.getRef().equals(rootCoordinates)
+        && bom.getComponents().stream().noneMatch(c -> c.getBomRef().equals(targetDep.getRef()))) {
       bom.addComponent(newComponent(targetRef, scope));
     }
     return this;

src/test/resources/msc/golang/expected_sbom_ca.json

@@ -13,14 +13,6 @@
     }
   },
   "components" : [
-    {
-      "type" : "application",
-      "bom-ref" : "pkg:golang/github.com/sample/demo-app@v0.0.0",
-      "group" : "github.com/sample",
-      "name" : "demo-app",
-      "version" : "v0.0.0",
-      "purl" : "pkg:golang/github.com/sample/demo-app@v0.0.0"
-    },
     {
       "type" : "library",
       "bom-ref" : "pkg:golang/github.com/gin-gonic/gin@v1.6.0",

src/test/resources/msc/golang/mvs_logic/expected_sbom_stack_analysis.json

@@ -13,14 +13,6 @@
     }
   },
   "components": [
-    {
-      "type": "application",
-      "bom-ref": "pkg:golang/github.com/rhecosystemappeng/saasi/deployer@v0.0.0",
-      "group": "github.com/rhecosystemappeng/saasi",
-      "name": "deployer",
-      "version": "v0.0.0",
-      "purl": "pkg:golang/github.com/rhecosystemappeng/saasi/deployer@v0.0.0"
-    },
     {
       "type": "library",
       "bom-ref": "pkg:golang/cloud.google.com/go@v0.52.0",

src/test/resources/tst_manifests/golang/go_mod_light_no_ignore/expected_sbom_component_analysis.json

@@ -14,14 +14,6 @@
     }
   },
   "components" : [
-    {
-      "type" : "application",
-      "bom-ref" : "pkg:golang/golang.org/x/example@v0.0.0",
-      "group" : "golang.org/x",
-      "name" : "example",
-      "version" : "v0.0.0",
-      "purl" : "pkg:golang/golang.org/x/example@v0.0.0"
-    },
     {
       "type" : "library",
       "bom-ref" : "pkg:golang/github.com/spf13/cobra@v0.0.5",

src/test/resources/tst_manifests/golang/go_mod_light_no_ignore/expected_sbom_stack_analysis.json

@@ -13,14 +13,6 @@
     }
   },
   "components": [
-    {
-      "type": "application",
-      "bom-ref": "pkg:golang/golang.org/x/example@v0.0.0",
-      "group": "golang.org/x",
-      "name": "example",
-      "version": "v0.0.0",
-      "purl": "pkg:golang/golang.org/x/example@v0.0.0"
-    },
     {
       "type": "library",
       "bom-ref": "pkg:golang/github.com/spf13/viper@v1.3.2",

src/test/resources/tst_manifests/golang/go_mod_no_ignore/expected_sbom_component_analysis.json

@@ -14,14 +14,6 @@
     }
   },
   "components" : [
-    {
-      "type" : "application",
-      "bom-ref" : "pkg:golang/github.com/rhecosystemappeng/saasi/deployer@v0.0.0",
-      "group" : "github.com/rhecosystemappeng/saasi",
-      "name" : "deployer",
-      "version" : "v0.0.0",
-      "purl" : "pkg:golang/github.com/rhecosystemappeng/saasi/deployer@v0.0.0"
-    },
     {
       "type" : "library",
       "bom-ref" : "pkg:golang/github.com/davecgh/go-spew@v1.1.1",

src/test/resources/tst_manifests/golang/go_mod_no_ignore/expected_sbom_stack_analysis.json

@@ -13,14 +13,6 @@
     }
   },
   "components": [
-    {
-      "type": "application",
-      "bom-ref": "pkg:golang/github.com/rhecosystemappeng/saasi/deployer@v0.0.0",
-      "group": "github.com/rhecosystemappeng/saasi",
-      "name": "deployer",
-      "version": "v0.0.0",
-      "purl": "pkg:golang/github.com/rhecosystemappeng/saasi/deployer@v0.0.0"
-    },
     {
       "type": "library",
       "bom-ref": "pkg:golang/github.com/stretchr/testify@v1.8.3",

src/test/resources/tst_manifests/golang/go_mod_no_path/expected_sbom_component_analysis.json

@@ -13,13 +13,6 @@
     }
   },
   "components" : [
-    {
-      "type" : "application",
-      "bom-ref" : "pkg:golang/rhda-test@v0.0.0",
-      "name" : "rhda-test",
-      "version" : "v0.0.0",
-      "purl" : "pkg:golang/rhda-test@v0.0.0"
-    },
     {
       "type" : "library",
       "bom-ref" : "pkg:golang/github.com/emicklei/go-restful/v3@v3.0.0",

src/test/resources/tst_manifests/golang/go_mod_no_path/expected_sbom_stack_analysis.json

@@ -12,13 +12,6 @@
     }
   },
   "components": [
-    {
-      "type": "application",
-      "bom-ref": "pkg:golang/rhda-test@v0.0.0",
-      "name": "rhda-test",
-      "version": "v0.0.0",
-      "purl": "pkg:golang/rhda-test@v0.0.0"
-    },
     {
       "type": "library",
       "bom-ref": "pkg:golang/github.com/json-iterator/go@v1.1.9",

src/test/resources/tst_manifests/golang/go_mod_with_all_ignore/expected_sbom_component_analysis.json

@@ -13,14 +13,6 @@
     }
   },
   "components": [
-    {
-      "type": "application",
-      "bom-ref": "pkg:golang/github.com/devfile-samples/devfile-sample-go-basic@v0.0.0",
-      "group": "github.com/devfile-samples",
-      "name": "devfile-sample-go-basic",
-      "version": "v0.0.0",
-      "purl": "pkg:golang/github.com/devfile-samples/devfile-sample-go-basic@v0.0.0"
-    },
     {
       "type": "library",
       "bom-ref": "pkg:golang/github.com/miekg/dns@v1.1.12",