Include bom-ref value within component hash calculation

Fixes CycloneDX#540

Signed-off-by: wkoot <[email protected]>

Author: wkoot

cyclonedx/model/component.py

@@ -1783,7 +1783,7 @@ def __hash__(self) -> int:
             self.mime_type, self.supplier, self.author, self.publisher,
             self.description, self.scope, tuple(self.hashes),
             tuple(self.licenses), self.copyright, self.cpe,
-            self.purl,
+            self.purl, self.bom_ref.value,
             self.swid, self.pedigree,
             tuple(self.external_references), tuple(self.properties),
             tuple(self.components), self.evidence, self.release_notes, self.modified,

tests/test_model_component.py

@@ -219,6 +219,16 @@ def test_component_equal_3(self) -> None:
 
         self.assertNotEqual(c, c2)
 
+    def test_component_equal_4(self) -> None:
+        c = Component(
+            name='test-component', version='1.2.3', bom_ref='ref1'
+        )
+        c2 = Component(
+            name='test-component', version='1.2.3', bom_ref='ref2'
+        )
+
+        self.assertNotEqual(c, c2)
+
     def test_same_1(self) -> None:
         c1 = get_component_setuptools_simple()
         c2 = get_component_setuptools_simple()