Export SBOM - DESCRIBES relationship is required

[aleksandrserbin]

Select Topic Area

Question

Body

Hello, I am using an API for SBOM export, and the resulting SBOM does not contain DESCRIBES relationship, which seems to be mandatory according to the SPDX spec.

Note this is a logical relationship to help organize related items within an SPDX document that is mandatory if more than one package or set of files (not in a package) is present.

If I interpret it correctly, this relationship has to be specified whenever there is more than one element in packages list to declare which package is the "root" and bind it with the whole document.

[aleksandrserbin]

Github SBOM contains documentDescribes field which should mean the same as a relationship with DESCRIBE, so maybe it is an issue from the side of the SBOM reader