Fixed bug where load components only returns components found by the same scanner and not by others

Author: patrick.rissmann@l3montree.com

internal/core/assetversion/asset_version_service.go

@@ -336,8 +336,8 @@ func buildBomRefMap(bom normalize.SBOM) map[string]cdx.Component {
 
 func (s *service) UpdateSBOM(assetVersion models.AssetVersion, scannerID string, sbom normalize.SBOM) error {
 	// load the asset components
-	scannerID = "AdditionalScanner"
-	assetComponents, err := s.componentRepository.LoadComponents(nil, assetVersion.Name, assetVersion.AssetID, scannerID)
+
+	assetComponents, err := s.componentRepository.LoadComponents(nil, assetVersion.Name, assetVersion.AssetID, "")
 	if err != nil {
 		return errors.Wrap(err, "could not load asset components")
 	}

internal/database/repositories/component_repository.go

@@ -200,22 +200,27 @@ func (c *componentRepository) HandleStateDiff(tx core.DB, assetVersionName strin
 	needToBeChanged := comparison.InBoth
 
 	return c.GetDB(tx).Transaction(func(tx *gorm.DB) error {
+		//We remove the scanner id from all components in removed and if it was the only scanner id we remove the component
 		dependenciesToUpdate, err := removeScannerIDFromComponents(tx, c, removed, scannerID)
 		if err != nil {
 			return err
 		}
+
+		//Now we want to update the database with the new scanner id values
 		if len(dependenciesToUpdate) > 0 {
 			err := c.db.Save(dependenciesToUpdate).Error
 			if err != nil {
 				return err
 			}
 		}
 
+		//Next step is adding the scanner id to all existing component dependencies we just found
 		for i := range needToBeChanged {
 			if !strings.Contains(needToBeChanged[i].ScannerIDs, scannerID) {
 				needToBeChanged[i].ScannerIDs = needToBeChanged[i].ScannerIDs + scannerID + " "
 			}
 		}
+		//We also need to update these changes in the database
 		if len(needToBeChanged) > 0 {
 			err := c.db.Save(needToBeChanged).Error
 			if err != nil {
@@ -229,6 +234,7 @@ func (c *componentRepository) HandleStateDiff(tx core.DB, assetVersionName strin
 			added[i].AssetVersionName = assetVersionName
 		}
 
+		//At last we create all the new component dependencies
 		return c.CreateComponents(tx, added)
 	})
 }