Enhancement to SPDX relationship between input document(s) and new document.

[par-anderssonTE]

Currently, as far as I can tell, in hierarchical merge there is some pedigree tracking between the new document and the input document(s) (there are AMENDS relationships). Augment does not seem to track this though, and I haven't checked the other strategies.

This is better than nothing but I think it's not entirely accurate.

The reason I don't think AMENDS is entirely appropriate is that the new document doesn't really add any new information to the INPUT documents (except when the new top level document is an updated version of a primary document, in that case the new document AMENDS the old document, but only for the primary one). The information flow really goes in the other direction in my opinion, although I think you could make a weak argument that AMENDS is the "least inappropriate" given the SPDX limitations. Unfortunately, there's no DOCUMENT -> CONSOLIDATED_FROM -> DocumentRef-A or similar.

I think an OTHER relationship with comment that explains that the current document is consolidated from the other document would be more appropriate.

Maybe this isn't the best solution either, it's annoying that there's not a native SPDX relationship specifically for describing document consolidation into a new document.

My alternative suggestion if you don't want to change from AMENDS is to at least add a comment that explains that this relationship is to indicate that the current document was consolidated from other documents.

EDIT: A DESCRIBED_BY reference to the original document for each consolidated package is another approach that might be even better, especially if complemented by a comment. This does not exactly say that the current document is a product of consolidation, but still makes it implicit and allows for verifying the package information in the current document towards the source document.

[riteshnoronha]

spdx

Actually we are entirely missing pedigree tracking at the document level.

1. Hierarchical/Flat/Assembly Merge:
   • Creates DESCRIBES relationship between new document and primary package
   • Creates CONTAINS relationships between primary package and described
   packages from input documents
   • Does NOT create any document-level relationships to track consolidation
   source
2. Augment Merge:
   • Modifies the primary SBOM in-place
   • Adds/merges packages from secondary SBOMs
   • Does NOT create any relationships to track the augmentation source
3. Missing Document Relationships: Neither strategy creates relationships
   between the new/modified document and the source documents to indicate
   consolidation pedigree.

This seems like a good feature, as i can imagine people would like to know how an SBOM was constructed.

I'm thinking of making this as a cmdline option.

     --pedigree-tracking  flag (default: true)
    --pedigree-relationship-type (default: OTHER) option (OTHER, DESCRIBED_BY, or AMENDS)
    --pedigree-comment  option for custom relationship comments

cyclonedx

CycloneDx however does not have an elegant solution for this either, atleast to my kn owledge, I'm thinking maybe annotations to the primary component as notes.

I probably need to spend more time thinking about this, let me get back.

[riteshnoronha]

@par-anderssonTE thought about this a bit more and seems like a good feature to help track provenance. Will add it to our next release. Thanks