Adding NOASSERTION/NONE to DocumentRef in relationships as per the spdx v2.3 spec about tools-python HOT 3 OPEN

@ShubhankarVN I believe the syntax allows for NONE and NOASSERTION without the preceeding DocumentRef-.

So the following should work:

{
"spdxElementId": "SPDXRef-Package-1",
"relatedSpdxElement": "NOASSERTION",
"relationshipType": "DESCRIBED_BY"
}
{
"spdxElementId": "SPDXRef-Package-1",
"relatedSpdxElement": "NONE",
"relationshipType": "DESCRIBED_BY"
}

from tools-python.

The scenario we are trying is where the Package and External Document Refs are related and both IDs are known, but the exact internal SPDXID that's part of the DocumentRef is not known.

In the below example, SPDXRef-Package-1 and DocumentRef-1 are known IDs, but the exact internal SPDXID that's part of DocumentRef-1 is unknown, hence NOASSERTION/NONE.

E.g.:
{
"spdxElementId": "SPDXRef-Package-1",
"relatedSpdxElement": "DocumentRef-1:NOASSERTION",
"relationshipType": "DESCRIBED_BY"
}

What can be done in this scenario?

from tools-python.

What can be done in this scenario?

The spec currently doesn't support referring to an unknown SPDX ID within an external document.

What I would suggest is creating a relationship to the document itself which has a pre-defined known ID - e.g.:

{
"spdxElementId": "SPDXRef-Package-1",
"relatedSpdxElement": "DocumentRef-1:SPDXRef-DOCUMENT",
"relationshipType": "DESCRIBED_BY"
}

from tools-python.