Repository: oss-review-toolkit/ort

Issue #10054: Empty scan results from failed runs are stored and reused even if the failure cause gets fixed and a new scan is triggered
Created: 2025-03-18T15:38:06Z
Describe the bug
When scancode completely fails to scan a package for whatever reason, no meaningful log message is shown and the processing goes on, until ORT finds that the temporary report.json output file from scancode is not there and throws a FileNotFoundException error, like in:
11:40:01.114 [main] ERROR org.ossreviewtoolkit.scanner.PathScannerWrapper - Failed to scan
RepositoryProvenance(vcsInfo=VcsInfo(type=Git, url=https://github.com/flozz/StackBlur.git, 
revision=1b85fe57ae5c2e7beeff157e1f9f7c7a7082f537, path=), resolvedRevision=1b85fe57ae5c2e7beeff157e1f9f7c7a7082f537)
with path scanner 'ScanCode': FileNotFoundException: /tmp/ort-ScanCode16441962167167250959/result.json (No such file or 
directory)

What is worse, the result with the generic error gets saved in ~/.ort/scanner/artifact/<name>/scan-results.yml, so it gets reused and the corresponding package never gets scanned again even if you fix the problem you had with ScanCode, and you will continue seeing the same error in the next runs of ort scan, unless you delete all the (wrong) cached results.
To Reproduce
Steps to reproduce the behavior:

force scancode to fail, f.e. add a wrong configuration entry for scancode in config.yml, like:

ort:
    config:
      ScanCode:
        options:
          commandLine: '--copyright --license --info --strip-root --timeout 600'
(since ORT 52.0.0, the commandLine field should contain parameters separated by comma and not by space; the correct value would be '--copyright,--license,--info,--strip-root,--timeout,600')

launch ort scan with the relevant options for your case
check the output log and the result file and see the generic error above
fix the scancode issue (in the example above, you should correct the commandLine value replacing spaces with commas)
re-run ort scan with the same parameters, check the result file and see that the errors are still there
delete all cached results with generic errors:

to_delete=$(find ~/.ort/scanner -name *.yml -exec grep -l FileNotFoundException {} \;)
rm $to_delete

re-run ort-scan with the same parameters; check the result file and the errors should be gone

Expected behavior
ORT should detect when ScanCode completely fails to run, and it should report the error message it gets from ScanCode instead of ignoring the error and throwing a generic FileNotFoundException when it does not find the report. Otherwise when ScanCode fails for whatever reason, it is impossible to analytically debug the error and one may just guess.
Moreover, in case ScanCode completely fails to run, no result should be cached.
Console / log output
see above
Environment

ORT version: 54.0.0
Java version: 21
OS: Linux

But it should affect any previous version of ORT

Duplicate issue #4316: How to stop Scancode rescanning all artifacts again after a change in the command line options?
Created: 2021-07-29T13:11:22Z
Hello
I have noticed that every change to the command line arguments in .ort.conf
"ScanCode" {
          "commandLine" = "--copyright --license --info --strip-root --timeout 600 --ignore \"*nunit.framework.tests.dll\""
          "parseLicenseExpressions" = "true"
        }


as timeout value, files ignore, etc impacts the full rescan.
I have a NodeJS project with 1900 artifacts detected by ORT to be retrived and scanned. That action takes 6h to run a full scanner turn. Next scan with the same parameters takes 1 minute (storeage: artifactory)
sometimes I obtain an error from Scan code:
ERROR: Timeout after   300 seconds while scanning file 'scipy-1.5.4/scipy/misc/ascent.dat'.
or
12:03:06.072 [main] ERROR org.ossreviewtoolkit.scanner.ScanException - Could not scan 'NPM::selenium-webdriver:3.6.0' (1 of 7): ScanException: Running '/usr/local/bin/scancode --copyright --license --info --strip-root --timeout 600 --ignore "third_party/dotnet/nunit-3.6.0/*" --processes 7 /tmp/ort-ScanCode2455747414402886768/NPM/unknown/selenium-webdriver/3.6.0 --json-pp /builds/n_DqkLj7/0/sqsc/home-in/ort/scanner/native-scan-results/NPM/unknown/selenium-webdriver/3.6.0/scan-results_ScanCode.json' in '/builds/n_DqkLj7/0/sqsc/home-in' failed with exit code 1:
Setup plugins...
Collect file inventory...
Scan files for: info, licenses, copyrights with 7 process(es)...
Scanning done.
Some files failed to scan properly:
Path: third_party/dotnet/nunit-3.6.0/net-2.0/nunit.framework.tests.dll
Path: third_party/dotnet/nunit-3.6.0/net-3.5/nunit.framework.tests.dll
Path: third_party/dotnet/nunit-3.6.0/net-4.0/nunit.framework.tests.dll
Path: third_party/dotnet/nunit-3.6.0/net-4.5/nunit.framework.tests.dll
Path: third_party/dotnet/nunit-3.6.0/netstandard16/nunit.framework.tests.dll
Path: third_party/dotnet/nunit-3.6.0/portable/nunit.framework.tests.dll
Summary:        info, licenses, copyrights with 7 process(es)
Errors count:   6

In that case the only thing I can do is to increase the timeout or ignore some files from the scan but these kind of change implicates ORT to scan the artifacts again for...6h.
Is there a way to omit that and reuse already scanned artifacts despite the fact that ScanCode parameters were changed?

Closing comment (2025-04-16T14:52:48Z): I went through this issue again, coming to the remaining problem of this:

Despite the fact that I configured an --ignore option or/and longer '--timeout' I obtained the same results because ORT detected the same ScanCode configurations
So first I had to remove the scan-results.yml file from the storage before the rescan.

Which I believe to be a duplicate of #10054.