duplicate spdx_id

[vargenau]

It is possible that different files contain the same package.

This is a toy example, but in real SBOMs (that I cannot provide for confidentiality reasons), it happens often.

You should create different spdx_ids, or create a single instance of the package if it is exactly the same in both files.

duplicate1.spdx.txt
duplicate2.spdx.txt

sbomasm assemble -n merge -v 1 -t application -o merge.spdx.json *.spdx

merge.spdx.json

pyspdxtools -i merge.spdx.json 
ERROR:root:The document is invalid. The following issues have been found:
every spdx_id must be unique within the document, but found the following duplicates: ['SPDXRef-Package-crypto-js']

[riteshnoronha]

Yes i had this implemented for cyclonedx but never ported it over the SPDX. Thanks for calling it out. fixed here #84

[riteshnoronha]

v0.1.4 has been released with this fix.

[vargenau]

@riteshnoronha
Thank you very much.
I now get fully valid SPDX on my real-world example.

[riteshnoronha]

@vargenau great to hear. 👍