-
Notifications
You must be signed in to change notification settings - Fork 12
Description
If my primary document has CONTAINS relationships to external documents, and I then augment my primary document with the same external documents in order to add the packages directly under the primary document, the resulting document will have the secondary packages added to "packages" with DESCRIBES relationship between the current document and the new package elements, but still has the externalDocumentRefs and CONTAINS relationships to the external documents. Both relationships are incorrect/non-compliant in my opinion.
The DESCRIBES part is related to 227, so this ticket is about the relationships between the new packages and their originating documents.
It's a bit of an edge case so it's difficult to say exactly what the expected behaviour should be as it kind of depends on the usecase but I think that either the externalDocumentRef should be removed, or that the relationship structure should be changed a bit.
One potential solution is that the updated relationship structure could be:
spdxRef-primary-package -> same_relation_type_as_the_previous_externalref -> spdxRef-added-package
spdxRef-added-package -> DESCRIBED_BY -> externalDocumentRef-added-package-original-doc
This DESCRIBED_BY proposal could also potentially be an approach to 228 (I've updated that one with this idea.) as a way of tracking document pedigree in an implicit way.