Fix document-level SPDX identifiers

[twaugh]

No description provided.

[mprpic]

Ha, I was actually writing this up into the docs and thought about fixing this to resemble something closer to reality. Any reason not to set it to just SPDXRef-[UUID] here? In the docs I also noted that we could have some name between the SPDXRef part and the UUID part to help humans identify things when browsing relationships, but I'm not sure which exact values I'd add there.

[mprpic]

Mmm, now I saw the Slack thread about this. Re-reading the SPDX docs, I guess I misunderstood what this value should be set to. It's merely an ID of the document itself that can be used within the relationship objects. The unique identifier of the document in a set of documents should be the documentNamespace then (even though in the JSON schema it's not a required attaibute)? Am I reading the spec wrong?

Also, if references are used between two different docs, shouldn't they use the SPDXID value?

[twaugh]

Mmm, now I saw the Slack thread about this. Re-reading the SPDX docs, I guess I misunderstood what this value should be set to. It's merely an ID of the document itself that can be used within the relationship objects. The unique identifier of the document in a set of documents should be the documentNamespace then (even though in the JSON schema it's not a required attaibute)? Am I reading the spec wrong?

Spec says it has to be that specific string: https://spdx.github.io/spdx-spec/v2.3/document-creation-information/#631-description

And yes, documentNamespace is the unique identifier in a document set, and the spec says it is required: https://spdx.github.io/spdx-spec/v2.3/document-creation-information/#65-spdx-document-namespace-field

Both of these points are not reflected accurately in the JSON Schema I think.

Also, if references are used between two different docs, shouldn't they use the SPDXID value?

For externalDocumentRef? It would be something like "my-external-doc:SPDXRef-Document" if you want to refer to the actual document itself.

[mprpic]

Also, if references are used between two different docs, shouldn't they use the SPDXID value?

For externalDocumentRef? It would be something like "my-external-doc:SPDXRef-Document" if you want to refer to the actual document itself.

Gotcha, and my-external-doc here is the documentNamespace value.

That JSON schema really isn't great...

[twaugh]

Also, if references are used between two different docs, shouldn't they use the SPDXID value?

For externalDocumentRef? It would be something like "my-external-doc:SPDXRef-Document" if you want to refer to the actual document itself.

Gotcha, and my-external-doc here is the documentNamespace value.

It would be the short ID string. So actually it would be more like "DocumentRef-my-doc:SPDXRef-Document". https://spdx.github.io/spdx-spec/v2.3/document-creation-information/#66-external-document-references-field