broken-dependency: target ref not found

[pazourek]

I have run the sbomqs compilance test on a local SPDX SBOM and the dependencies on other components field shows an error broken-dependencies File-usr-bin-rsync not found. But looking in the SBOM, I can find such a SPDXRef. It seems that this happens for all components that do not define its dependencies in the SBOM.

Steps to reproduce:
Run sbomqs compliance -s test-sbom.spdx.json

Environment:
GitVersion: v2.0.6
GitCommit: 11de6ca
GitTreeState: clean
BuildDate: 2026-03-31T07:17:51Z
GoVersion: go1.25.0
Compiler: gc
Platform: linux/amd64
System: Ubuntu 25.10

Or am I overlooking some issue in the SBOM myself?
Thanks!

test-sbom.spdx.json
test-sbomqs.txt

[viveksahu26]

Hey @pazourek , thanks for raising an issue. You are right, this is a bug. As per BSI dependency def: all the reference i.e. whether source or target must be present in the components list. As of current implementation in sbomqs, we check the reference or target elements in components section only, whereas not in files section. As a result, this misses out and throws and issues of reference or target element not found in component section, as a result shows "dependency-broken". THis needs to be extended to files section too, as SPDX can have dependency on files too..

[riteshnoronha]

@pazourek thanks for the detailed report and the test SBOM — you're right, this is a bug.

Your SBOM is valid. The CONTAINS relationship from the rsync package to SPDXRef-File-usr-bin-rsync is perfectly legitimate SPDX, and sbomqs is incorrectly flagging it as a broken dependency in two places:

• Document-level ("dependency graph completeness"): The graph integrity check validates that all relationship targets exist, but only looks at packages — not files. Since SPDXRef-File-usr-bin-rsync is defined in the files section, it's reported as "target ref not found" even though it exists in the SBOM.

• Component-level ("dependencies on other components"): The code treats CONTAINS the same as DEPENDS_ON, then fails to find the file target. Per the BSI spec (§5.2.2), this field is about dependencies on other components, not containment. A package containing its own binary is not a dependency — your rsync component should be scored as a leaf with no dependencies.

We will get this fixed in the next release, if this is blocking your work, let us know we can get this fixed faster.