Add unit tests for issue trustification#1151: Denote upstream relationship from CycloneDX

[chirino]

No description provided.

[chirino]

This resolves #1151

[jcrossley3]

I guess you didn't see #1168 , huh?

One of us is wrong -- probably me -- because as I understood the issue, I needed to swap the left and right sides of the relationship in the ingestor. I do show the relationships in both root-component and deps but I could be passing the wrong purl's to each. 🤷

Also, that purl endpoint isn't correct -- it's only working because the bom-ref's are actual purl's in the test-data, but I don't think we can rely on that, so @ctron suggested we not expose the relationships through that endpoint at all.

We can discuss further tomorrow.

[chirino]

@jcrossley3 rebased off your changes, only thing this PR adds now is an additional unit test for the purl endpoint.

[jcrossley3]

@jcrossley3 rebased off your changes, only thing this PR adds now is an additional unit test for the purl endpoint.

I'm in the process of reverting the purl endpoint changes, per @JimFuller-RedHat, so no relationships will be returned from it. I think you can safely delete this PR. 😄

[chirino]

sounds good.