Can not add relationshps to an ExternalSpdxElement

spdx / tools-java

SPDX Command Line Tools using the Spdx-Java-Library

Apache License 2.0

59 stars 34 forks source link

Can not add relationshps to an ExternalSpdxElement #162

Open vargenau opened 1 month ago

vargenau commented 1 month ago

example6-bin.spdx.txt This file is from spdx-examples/software/example6/spdx2.2

Tools Python says the file is valid SPDX.

Tools Java 1.1.8 says it is invalid:

Analysis exception processing SPDX file: Can not add relationshps to an ExternalSpdxElement. 
These changes must be done to the local SPDX element in the document which defines the SPDX element.

Who is right?

goneall commented 1 month ago

Preventing writes to the external element is intentional. A couple of thoughts:

In SPDX 2.X, the relationship is a property of the Element. Since the relationships are serialized along with the Element, we should not allow updates since they can not be written out.
In SPDX 3.X, relationships are not properties of the Element, they are stand-alone elements with a to and from property - so they can be "added" independent of the Element. We will be able to add relationships to external elements only for the 3.X spec versions - once the code for SPDX 3.X is complete.