Adds Annex for the Lite profile

[NorioKobota]

Adds the explanation for the Lite profile as Annex.

[kestewart]

Thanks for all the hard work in getting this pulled together.

This looks good to me, but I'd like either Rose, Gary or Alexios to review as well.

[goneall]

Overall, this looks quite good.

I do have one suggested change:

To process an SPDX Lite document, we'll need to know where to start - what package the Lite document is describing.

There are 2 options on SPDX 3.0:

• a relationship of type describes between the SPDX document and the package
• rootElement property

The simplest option IMHO is rootElement. For the Lite profile, I would suggest making this property required (cardinality 1..1) and have the package element be the value for the property.

[NorioKobota]

@goneall, @kestewart
Thanks for the review. I have a question to @goneall.

The simplest option IMHO is rootElement.

The SpdxDocument class has rootElement in this PR, but does the Sbom class also should have rootElement? Or does that mean rootElement in the SpdxDocument class should be 1..1?

Based on this JSON-LD sample, I think it's enough to have rootElement in SpdxDocument..

[goneall]

@goneall, @kestewart Thanks for the review. I have a question to @goneall.

The simplest option IMHO is rootElement.

The SpdxDocument class has rootElement in this PR, but does the Sbom class also should have rootElement? Or does that mean rootElement in the SpdxDocument class should be 1..1?

Based on this JSON-LD sample, I think it's enough to have rootElement in SpdxDocument..

Very good point about the SBOM.

I'm thinking that in a Lite document the document root element should point to the SBOM element collection and the SBOM root element should point to the package. Perhaps make them both required and add some documentation on the best practice for what these fields should contain?

[goneall]

LGTM - Thanks @NorioKobota