11 Relationships between SPDX elements information section

11.1 Relationship field

11.1.1 Description

This field provides information about the relationship between two SPDX elements. For example, you can represent a relationship between two different Files, between a Package and a File, between two Packages, or between one SPDXDocument and another SPDXDocument.

In cases where there are "known unknowns", the use of the keyword NOASSERTION can be used on the right hand side of a relationship to indicate that the author is not asserting whether there are other SPDX elements (package/file/snippet) that are connected by relationships or not. That is, there could be some, but the author is not asserting one way or another.

Similarly, the use of the keyword NONE can be used to indicate that an SPDX element (package/file/snippet) has no other elements connected by some relationship to it.

The use of NOASSERTIONor NONE is not mandatory for any relationship. If no relationship of a particular type is specified, then the document author is not presumed to be asserting whether or not there are relationships of that type. If some relationships of a particular type are specified, then the document author is not presumed to be asserting whether there are more possible relationships of that type.

The relationships between two SPDX elements that are supported are shown in Table 68.

Table 68 — Relationships between two SPDX elements that are supported

Relationship	Description	Example
DESCRIBES	Is to be used when SPDXRef-DOCUMENT describes SPDXRef-A.	An SPDX document `WildFly.spdx` describes package ‘WildFly’. Note this is a logical relationship to help organize related items within an SPDX document that is mandatory if more than one package or set of files (not in a package) is present.
DESCRIBED_BY	Is to be used when SPDXRef-A is described by SPDXREF-Document.	The package ‘WildFly’ is described by SPDX document `WildFly.spdx`.
CONTAINS	Is to be used when SPDXRef-A contains SPDXRef-B.	An ARCHIVE file `bar.tgz` contains a SOURCE file `foo.c`.
CONTAINED_BY	Is to be used when SPDXRef-A is contained by SPDXRef-B.	A SOURCE file `foo.c` is contained by ARCHIVE file `bar.tgz`
DEPENDS_ON	Is to be used when SPDXRef-A depends on SPDXRef-B.	Package A depends on the presence of package B in order to build and run
DEPENDENCY_OF	Is to be used when SPDXRef-A is dependency of SPDXRef-B.	A is explicitly stated as a dependency of B in a machine-readable file. Use when a package manager does not define scopes.
DEPENDENCY_MANIFEST_OF	Is to be used when SPDXRef-A is a manifest file that lists a set of dependencies for SPDXRef-B.	A file `package.json` is the dependency manifest of a package `foo`. Note that only one manifest should be used to define the same dependency graph.
BUILD_DEPENDENCY_OF	Is to be used when SPDXRef-A is a build dependency of SPDXRef-B.	A is in the `compile` scope of B in a Maven project.
DEV_DEPENDENCY_OF	Is to be used when SPDXRef-A is a development dependency of SPDXRef-B.	A is in the `devDependencies` scope of B in a Maven project.
OPTIONAL_DEPENDENCY_OF	Is to be used when SPDXRef-A is an optional dependency of SPDXRef-B.	Use when building the code will proceed even if a dependency cannot be found, fails to install, or is only installed on a specific platform. For example, A is in the `optionalDependencies` scope of npm project B.
PROVIDED_DEPENDENCY_OF	Is to be used when SPDXRef-A is a to be provided dependency of SPDXRef-B.	A is in the `provided` scope of B in a Maven project, indicating that the project expects it to be provided, for instance, by the container or JDK.
TEST_DEPENDENCY_OF	Is to be used when SPDXRef-A is a test dependency of SPDXRef-B.	A is in the `test` scope of B in a Maven project.
RUNTIME_DEPENDENCY_OF	Is to be used when SPDXRef-A is a dependency required for the execution of SPDXRef-B.	A is in the `runtime` scope of B in a Maven project.
EXAMPLE_OF	Is to be used when SPDXRef-A is an example of SPDXRef-B.	The file or snippet that illustrates how to use an application or library.
GENERATES	Is to be used when SPDXRef-A generates SPDXRef-B.	A SOURCE file `makefile.mk` generates a BINARY file `a.out`
GENERATED_FROM	Is to be used when SPDXRef-A was generated from SPDXRef-B.	A BINARY file `a.out` has been generated from a SOURCE file `makefile.mk`. A BINARY file `foolib.a` is generated from a SOURCE file `bar.c`.
ANCESTOR_OF	Is to be used when SPDXRef-A is an ancestor (same lineage but pre-dates) SPDXRef-B.	A SOURCE file `makefile.mk` is a version of the original ancestor SOURCE file ‘makefile2.mk’
DESCENDANT_OF	Is to be used when SPDXRef-A is a descendant of (same lineage but postdates) SPDXRef-B.	A SOURCE file `makefile2.mk` is a descendant of the original SOURCE file ‘makefile.mk’
VARIANT_OF	Is to be used when SPDXRef-A is a variant of (same lineage but not clear which came first) SPDXRef-B.	A SOURCE file `makefile2.mk` is a variant of SOURCE file `makefile.mk` if they differ by some edit, but there is no way to tell which came first (no reliable date information).
DISTRIBUTION_ARTIFACT	Is to be used when distributing SPDXRef-A requires that SPDXRef-B also be distributed.	A BINARY file `foo.o` requires that the ARCHIVE file `bar-sources.tgz` be made available on distribution.
PATCH_FOR	Is to be used when SPDXRef-A is a patch file for (to be applied to) SPDXRef-B.	A SOURCE file `foo.diff` is a patch file for SOURCE file `foo.c`.
PATCH_APPLIED	Is to be used when SPDXRef-A is a patch file that has been applied to SPDXRef-B.	A SOURCE file `foo.diff` is a patch file that has been applied to SOURCE file ‘foo-patched.c’.
COPY_OF	Is to be used when SPDXRef-A is an exact copy of SPDXRef-B.	A BINARY file `alib.a` is an exact copy of BINARY file `a2lib.a`.
FILE_ADDED	Is to be used when SPDXRef-A is a file that was added to SPDXRef-B.	A SOURCE file `foo.c` has been added to package ARCHIVE `bar.tgz`.
FILE_DELETED	Is to be used when SPDXRef-A is a file that was deleted from SPDXRef-B.	A SOURCE file `foo.diff` has been deleted from package ARCHIVE `bar.tgz`.
FILE_MODIFIED	Is to be used when SPDXRef-A is a file that was modified from SPDXRef-B.	A SOURCE file `foo.c` has been modified from SOURCE file `foo.orig.c`.
EXPANDED_FROM_ARCHIVE	Is to be used when SPDXRef-A is expanded from the archive SPDXRef-B.	A SOURCE file `foo.c`, has been expanded from the archive ARCHIVE file `xyz.tgz`.
DYNAMIC_LINK	Is to be used when SPDXRef-A dynamically links to SPDXRef-B.	An APPLICATION file ‘myapp’ dynamically links to BINARY file `zlib.so`.
STATIC_LINK	Is to be used when SPDXRef-A statically links to SPDXRef-B.	An APPLICATION file ‘myapp’ statically links to BINARY `zlib.a`.
DATA_FILE_OF	Is to be used when SPDXRef-A is a data file used in SPDXRef-B.	An IMAGE file ‘kitty.jpg’ is a data file of an APPLICATION ‘hellokitty’.
TEST_CASE_OF	Is to be used when SPDXRef-A is a test case used in testing SPDXRef-B.	A SOURCE file `testMyCode.java` is a unit test file used to test an APPLICATION MyPackage.
BUILD_TOOL_OF	Is to be used when SPDXRef-A is used to build SPDXRef-B.	A SOURCE file `makefile.mk` is used to build an APPLICATION ‘zlib’.
DEV_TOOL_OF	Is to be used when SPDXRef-A is used as a development tool for SPDXRef-B.	Any tool used for development such as a code debugger.
TEST_OF	Is to be used when SPDXRef-A is used for testing SPDXRef-B.	Generic relationship for cases where it's clear that something is used for testing but unclear whether it's TEST_CASE_OF or TEST_TOOL_OF.
TEST_TOOL_OF	Is to be used when SPDXRef-A is used as a test tool for SPDXRef-B.	Any tool used to test the code such as ESlint.
DOCUMENTATION_OF	Is to be used when SPDXRef-A provides documentation of SPDXRef-B.	A DOCUMENTATION file `readme.txt` documents the APPLICATION ‘zlib’.
OPTIONAL_COMPONENT_OF	Is to be used when SPDXRef-A is an optional component of SPDXRef-B.	A SOURCE file `fool.c` (which is in the contributors directory) may or may not be included in the build of APPLICATION ‘atthebar’.
METAFILE_OF	Is to be used when SPDXRef-A is a metafile of SPDXRef-B.	A SOURCE file `pom.xml` is a metafile of the APPLICATION ‘Apache Xerces’.
PACKAGE_OF	Is to be used when SPDXRef-A is used as a package as part of SPDXRef-B.	A Linux distribution contains an APPLICATION package gawk as part of the distribution MyLinuxDistro.
AMENDS	Is to be used when (current) SPDXRef-DOCUMENT amends the SPDX information in SPDXRef-B.	(Current) SPDX document A version 2 contains a correction to a previous version of the SPDX document A version 1. Note the reserved identifier SPDXRef-DOCUMENT for the current document is required.
PREREQUISITE_FOR	Is to be used when SPDXRef-A is a prerequisite for SPDXRef-B.	A library `bar.dll` is a prerequisite or dependency for APPLICATION `foo.exe`
HAS_PREREQUISITE	Is to be used when SPDXRef-A has as a prerequisite SPDXRef-B.	An APPLICATION `foo.exe` has prerequisite or dependency on `bar.dll`
OTHER	Is to be used for a relationship which has not been defined in the formal SPDX specification. A description of the relationship should be included in the Relationship comments field.

The metadata for the relationship field is shown in Table 69.

Table 69 — Metadata for the relationship field

Attribute	Value
Required	No
Cardinality	0..* see `DESCRIBES` relationship for one mandatory case.
Format	["DocumentRef-"[idstring]":"]SPDXID \<relationship> ["DocumentRef-"[idstring]":"]`SPDXID` \| `NONE` \| `NOASSERTION` where "DocumentRef-"`[idstring]`":" is an optional reference to an external SPDX document as described in 6.6 where `SPDXID` is a string containing letters, numbers, `.` and/or `-`. as described in 6.3, 7.2, 8.2. where `<relationship>` is one of the documented relationship types in Table 68. where `NONE` can be used to explicitly indicate there are NO other relationships. where `NOASSERTION` can be used to explicitly indicate it is not clear if there are relationships that may apply or not.

11.1.2 Intent

Here, this field is a reasonable estimation of the relation between two identified elements (i.e. files or packages, or documents), from a developer perspective.

11.1.3 Examples

EXAMPLE 1 Tag: Relationship:

Relationship: SPDXRef-grep CONTAINS SPDXRef-make

RelationshipComment: Package grep contains file make

Relationship: SPDXRef-DOCUMENT AMENDS DocumentRef-SPDXA:SPDXRef-DOCUMENT

RelationshipComment: This current document is an amendment of the SPDXA document.

Relationship: SPDXRef-CarolCompression DEPENDS_ON NONE

RelationshipComment: The package CarolCompression can be considered as a root with no dependencies.

Relationship: SPDXRef-BobBrowser CONTAINS NOASSERTION

RelationshipComment: The package BobBrowser may have other packages embedded in it, but the author has insufficient information to treat this as other than unknown at this point in time.

EXAMPLE 2 RDF: Property spdx:relationship in any spdx:SpdxDocument, spdx:Package, spdx:File or spdx:Snippet

<File rdf:about="#SPDXRef-45">
  <relationship>
    <Relationship>
      <relatedSpdxElement>
        <File rdf:about="http://spdx.org/spdxdocs/spdx-tools-v1.2-3F2504E0-4F89-41D3-9A0C-0305E82..."/>
      </relatedSpdxElement>
      <relationshipType>http://spdx.org/rdf/terms#relationshipType_contains
      </relationshipType>
    </Relationship>
  </relationship>
  ...
</File>

11.2 Relationship comment field

11.2.1 Description

This field provides a place for the SPDX document creator to record any general comments about the relationship. The metadata for the relationship comment field is shown in Table 70.

Table 70 — Metadata for the relationship comment field

Attribute	Value
Required	No
Cardinality	0..1
Format	Free form text that may span multiple lines, refers only to the immediately preceding relationship.

11.2.2 Intent

Here, the intent is to provide the recipient of the SPDX document with more information determined after careful analysis of the relationship between two elements in an SPDX document.

11.2.3 Examples

EXAMPLE 1 Tag: RelationshipComment:

In tag:value format multiple lines are delimited by <text> .. </text>.

A RelationshipComment: shall be the line immediately after a “Relationship:”

RelationshipComment: <text>The package foo.tgz is a pre-requisite for building executable bar.</text>

EXAMPLE 2 RDF: Property rdfs:comment in class spdx:Relationship

<Relationship rdf:about="...">
  <rdfs:comment>
    The package foo.tgz is a pre-requisite for building executable bar.
  </rdfs:comment>

  ...

</Relationship>