[FEATURE] When a BOM is generated with zero Components, `components` is still present in the generated BOM

[madpah]

Very minor issue noted here.

If a BOM is has ZERO Components, components is still included in the generated BOM as an empty array.

Not invalid, but not tidy.

[jkowalleck]

not a bug, but a feature... and a requirement.

an a requirement for CycloneDX spec 1.0 requires the presence of bom.components
see https://github.com/CycloneDX/specification/blob/ccbf7b5781ef534cd62616e3c4221004c7c82a66/schema/bom-1.0.xsd#L215

an a requirement for CycloneDX spec 1.1 requires the presence of bom.components
https://github.com/CycloneDX/specification/blob/ccbf7b5781ef534cd62616e3c4221004c7c82a66/schema/bom-1.1.xsd#L687

since spec 1.2 bom.components is optional
see https://github.com/CycloneDX/specification/blob/ccbf7b5781ef534cd62616e3c4221004c7c82a66/schema/bom-1.2.xsd#L1360

[madpah]

Good call @jkowalleck - easiest to leave in then would you say?

[jkowalleck]

if this feature was implemented,
i would expect to have unit/integration tests that generate a BOM with empty components list and actually normalize the data to XML
and then validate the resulting XML with the known schema.
SO there should be one test for XML spec 1.0, one for ... , and one for 1.4
SO there should be one test for JSON spec 1.2, one for ... , and one for 1.4

---

@madpah dont know. This fix/feature does not actually change the resulting data. it is just a different representation.
its a task for rainy weekends, i guess. and a fun one, too.

what is the current situation?
is the generated XML lacking the required element, if components were empty?
or does the resulting XML have the component, but you want to get rid of it in spec >= 1.2 ?

[madpah]

https://pypi.org/project/cyclonedx-python-lib/2.0.0/ released