fix: Switch refs for dev and opt dependencies in SPDX sboms #6871
Conversation
This adjusts the relationships to match the explanations at https://spdx.github.io/spdx-spec/v2.3/relationships-between-SPDX-elements/ Fixes npm#6867 Signed-off-by: Anton Bauhofer <anton.bauhofer@tngtech.com>
|
This fixes the issue #6867 (which should still be open) |
|
Sorry for the confusion earlier today. I'll let @bdehamer review this |
|
Thanks for your support! I think the initial misunderstanding was caused by my imprecise comment on #6801, so I might be to blame for confusion here. |
|
@bdehamer : this is still a bug in npm and it would benefit from your review. |
|
@maxhbr if SPDX is ok with inverting those relationships for This would make the direction of the relationship consistent across all four types (and eliminate some complexity from the implementation). |
|
Yes, I agree that this would be an option. We implemented that in https://github.com/npm/cli/pull/6868/files |
|
Closing this in favor of #7036 so that we can swap the direction for ALL of the relationship types. |
As pointed out in this comment, the relationships in SPDX sboms are currently incorrect.
In order to keep the directions as intuitive as possible, we leave them as is for dependencies and prerequisites, and only swap the refs for dev and optional dependencies, where it is currently not correct.
Fixes #6867