code: public synchronized void addSoftwareIdentifier(Identifier identifier) {
          //todo the following assertion should be removed after initial testing and implementation
          assert !(identifier instanceof CpeIdentifier) : "vulnerability identifier cannot be added to software identifiers";
  
          final Optional<Identifier> found = softwareIdentifiers.stream().filter(id
                  -> id.getValue().equals(identifier.getValue())).findFirst();
          if (found.isPresent()) {
              //TODO - should we check for type of identifier?  I.e. could we see a Purl and GenericIdentifier with the same value
              final Identifier existing = found.get();
              if (existing.getConfidence().compareTo(identifier.getConfidence()) < 0) {
                  existing.setConfidence(identifier.getConfidence());
              }
              if (existing.getNotes() != null && identifier.getNotes() != null) {
                  existing.setNotes(existing.getNotes() + " " + identifier.getNotes());
              } else if (identifier.getNotes() != null) {
                  existing.setNotes(identifier.getNotes());
              }
              if (existing.getUrl() == null && identifier.getUrl() != null) {
                  existing.setUrl(identifier.getUrl());
              }
          } else {
              this.softwareIdentifiers.add(identifier);
          }
      }
docs: Adds an entry to the list of detected Identifiers for the dependency
  file.
  
  @param identifier a reference to the identifier to add