BomRefDiscriminator.from_bom() does not collect citation bom-refs (CycloneDX 1.7) #1068

BomRefDiscriminator.from_bom() only gathers bom-refs from components, services, and vulnerabilities:

# cyclonedx/contrib/bom/utils.py (BomRefDiscriminator.from_bom, around lines 89-103)
return cls(chain(
    (c.bom_ref for c in bom._get_all_components()),
    (s.bom_ref for s in bom.services),
    (v.bom_ref for v in bom.vulnerabilities),
), prefix)

CycloneDX 1.7 added bom.citations. Each Citation may carry a bom_ref (cyclonedx/model/citation.py, Citation.bom_ref). The 1.7 schema requires bom-ref values to be unique across all elements, but citation bom-refs are not passed into the discriminator.

JSON and XML serialization both enter with BomRefDiscriminator.from_bom(bom): before writing the document (cyclonedx/output/json.py around line 74, cyclonedx/output/xml.py around line 64). Empty or colliding citation bom-refs are therefore not de-duplicated against the rest of the BOM at output time.

This was left out of scope in #1064 (citations on Bom for v1.7) and noted as a follow-up by jkowalleck: #1064 (comment)

Suggested follow-up

Include citation bom-refs in from_bom(), for example (c.bom_ref for c in bom.citations), and add tests that cover uniqueness against components, services, and vulnerabilities, plus empty citation bom-refs.