Using cdxgen as a library?

[prabhu]

If you're using cdxgen as a library, can you ensure you set the pedigree.ancestors information under metadata.tools.components? You can essentially copy the value from metadata.tools.components[0].

https://cyclonedx.org/docs/1.6/json/#metadata_tools_oneOf_i0_components_items_pedigree_ancestors

This will help propagate the validation rules and trusts as we build new, powerful tools to verify xBOMs (Say for public agencies). Tools that lack ancestry would be considered newish and unverified by default, which might not be desirable.