relationship between spdx doc and package