Repository: oss-review-toolkit/ort

Issue #2896: Trouble running the analyzer / scanner on a directory not under Version Control
Created: 2020-07-31T13:26:33Z
Hello,
I sucessfully created a scan result with the following command. (I used the scancode-toolkit examples.)
cli\build\install\ort\bin\ort scan -p "C:\scancode-toolkit-3.1.1\samples" -o myOut
Output:
Using scanner 'ScanCode' with storage 'FileBasedStorage with XZCompressedLocalFileStorage backend'.
Local file storage has 0 scan results files.
Writing scan result to 'myOut\scan-result.yml'.

If I look at the .yml file, it looks good and contains many licensed.
Now I try to generate any kind of report. My goal is to generate an attribution notice. So I run the command:
cli\build\install\ort\bin\ort report -i myOut\scan-result.yml -o myOutReport -f Excel
but the output shows the error
Creating the 'Excel' report...
15:15:23.583 [main] ERROR org.ossreviewtoolkit.commands.ReporterCommand - Could not create 'Excel' report: IllegalArgumentException: The provided ORT result does not contain an analyzer result.
Failed to create any report.

For -f NoticeSummary, or -f NoticeByPackage OSS-RT seems to work at first glance:
Creating the 'NoticeSummary' report...
Successfully created the 'NoticeSummary' report at [myOutReport\NOTICE_SUMMARY] in 0.012422699s.
Successfully created 1 of 1 report(s).

But despite the many licenses in the .yml,  the resulting report is empty, i.e. it says:
This project neither contains or depends on any third-party software components.
What is the problem, or how can this be fixed?
I attached my scan result for easy reference.
scan-result.yml.txt

Duplicate issue #4958: Scanning a non package managed source tree
Created: 2022-01-14T13:51:54Z
Hi,
I am wanting to scan a source tree containing C/C++ source code/headers.  In this instance as just a test to see what kind of output I can get, it is not in source control and is not package managed.
A good example of a use case for this might be an archive from a supplier that we wish to check for licensing information, or one that we are shipping to a customer.
I am following the steps in the getting started guide but on my local code package instead.
Doing this I see issues similar to #2896
If instead of running the scanner on the analyser output I instead pass the source folder with the -p option, the scan runs correctly and detects licenses in the code, however this information then never makes it into the reports, and the evaluator runs without picking up any issues. But the report is empty.
`
docker run -v /home/paulb/work/fsim_scan:/project ort --info analyze -f JSON -i /project/FSIM_minimal -o /project/ort/analyzer
As we know the system is not package managed, for the scan we could just pass the path to the code rather than the analyser output
docker run -v /home/paulb/work/fsim_scan:/project ort --info scan -p /project/FSIM_minimal -o /project/ort/scanner
docker run -v /home/paulb/work/fsim_scan:/project ort --info evaluate  --license-classifications-file /project/license-classifications.yml --rules-file /project/example.rules.kts -i /project/ort/scanner/scan-result.yml -o project/ort/evaluator
docker run -v /home/paulb/work/fsim_scan:/project ort --info report -f NoticeTemplate,StaticHtml,WebApp -i /project/ort/evaluator/evaluation-result.yml -o project/ort/reporter
`
I use the license-classifications and example.rules from the examples folder.
Analyse step, doesn't find anything (as I would expect as it isn't package managed).
Scan step (given the path rather than analyser output) finds licenses and copyrights.
Evaluate finds no issues
Report is empty.
Does this look like a bug, or am I driving it wrong?
Thanks,
Paul

Closing comment (2023-03-07T09:20:40Z): So, there is an agreement to add support for scanning sources not under source / version control, but so far no one has started to work on it.

I don't recall the details of this "agreement". @oss-review-toolkit/core-devs should discuss whether we really want to officially support this use-case.
Anyway, this issue is actually conflating to separate things:

Analyzing source code that does not use a package manager. This is supported via the Unmanaged "fake" package manager.
Analyzing source code that is not checked into a Version Control System, which is not fully supported / untested.

So the only real issue is 2., which is a duplicate of #2896. Let's track it over there.