feat: update SBOM external reference type for source code URLs from `…

[tngraf]

Update SBOM external reference type for source code URLs from distribution
to source-distribution.

[gernot-h]

Should we perhaps make this backward-compatible in central places when consuming an SBOM, probably users still have old (custom) scanners in use?

[gernot-h]

I think there's get_ext_ref_source_url() for backward-compatible parsing, can we just call it here?

[tngraf]

Good point. Unfortunately get_ext_ref_source_url() returns a string, but we need the ExternalReference. I have fixed it accordingly.

[gernot-h]

Just cosmetics, I think it would be better if we would use None instead of "" for the comment parameter in get_ext_ref(), think this expresses better our intention. This would however mean a bunch of changes to your MR, not sure if it's worth the effort.

[gernot-h]

Apart from the comments above, the PR looks good, but I didn't test it yet, let me know if I should give it a try!

[tngraf]

Just cosmetics, I think it would be better if we would use None instead of "" for the comment parameter in get_ext_ref(), think this expresses better our intention. This would however mean a bunch of changes to your MR, not sure if it's worth the effort.

Honstly, I added "" and I didn't care... now it is None.

[tngraf]

Just cosmetics, I think it would be better if we would use None instead of "" for the comment parameter in get_ext_ref(), think this expresses better our intention. This would however mean a bunch of changes to your MR, not sure if it's worth the effort.

Aaarrgghhh, mypy error incompatible type "None"; expected "str"