Analyzer issue when scanning non VCS directory

[alexandruz]

Scanning a non-VCS directory gives the following error:

Steps:

1. Download zip from github, unzip.
2. run - ort analyze
3. Error.

Exception in thread "main" java.lang.IllegalArgumentException: The VcsInfo(...)
at org.ossreviewtoolkit.model.OrtResult.getFilePathRelativeToAnalyzerRoot(OrtResult.kt:233)
at org.ossreviewtoolkit.model.OrtResult.getDefinitionFilePathRelativeToAnalyzerRoot(OrtResult.kt:199)
...

Based on the https://github.com/oss-review-toolkit/ort/blob/main/model/src/main/kotlin/OrtResult.kt#L230 it shouldn't terminate in Exception in thread main, right?

Is there a workaround or ORT can only scan VCS repositories?
Thanks.

[sschuberth]

Closing this as a duplicate of #2896 and linked issues. In short, analyzing a directory that is not under version control is currently not supported.

[sschuberth]

Just curious @alexandruz, is your specific use-case maybe related to #4242, i.e. the analysis of archives uploaded to FOSSID via the API?

[alexandruz]

Yes, it's pretty much a similar workflow. Scanning archives without a VCS repository is the main use-case.

[sschuberth]

Thanks for confirming. Can you share some more details about FOSSID's use of ORT? I've heard rumors that FOSSID plans to use another SCA solution. However, if it'd help you continuing to use ORT, and if it'd also help @nnobelis for his use-case, we might be able to prioritize work on this.

[alexandruz]

Yes, we definitely plan to continue using ORT, and many of our customers are very much relying on ORT in combination with our tools. However, it's also true that we are developing other solutions that do not rely on ORT. In the future, we expect to offer a mix of both ORT-based and non-ORT-based solutions.

[sschuberth]

Thanks again for the insights @alexandruz! Esp. if at least the ORT analyzer is a part of ORT you'll continue to use, let's maybe have a chat how we could potentially collaborate. Feel free to reach out to me under my commit email address.