spdx / ntia-conformance-checker

Check SPDX SBOM for NTIA minimum elements
Apache License 2.0
52 stars 19 forks source link

Revise the implementation of check_dependency_relationships #182

Closed jspeed-meyers closed 5 months ago

jspeed-meyers commented 5 months ago

Fix #179

The check_dependency_relationships function must check that the document DESCRIBES at least one package. This is the official SPDX definition of this particular criteria for NTIA conformance. The previous implementation was simply erroneous.