SPDX generation for .NET project hosted in SVN

[sschuberth]

@xrayWorker, I've moved your post to a dedicated discussion:

Hi everyone,
I'm Benjamin and I'm about to setup ort as a tool to get a spdx file for our software. I've already got a copy of ort (ort-62.2.0) via releases and got it as far as the requirements to run an analyze are met (asterix at scanners: askalono, boyterLc, ScanCode and NuGetInspector (add sign only) as PackageManager).
My local setup I'm trying to run the analyzer on is a folder containing a .NET solution file with 3 subfolders, each containing a csproj file.

RAYWorXBase
│
├─ XRAYWorXBase/
│   └─ XRAYWorXBase.csproj
├─ XRAYWorXBase.Misc/
│   └─ XRAYWorXBase.Misc.csproj
├─ XRAYWorXBase.Tests/
│   └─ XRAYWorXBase.Tests.csproj
└─ XRAYWorXBase.sln

For versioning I'm using subversion. I'm running "ort analyze -i . -o .ort" from my solution folder getting the following output indication some confusion with the detected subversion folders:

Environment variables:
USERPROFILE = C:\Users\Dostal.ALF3
OS = Windows_NT
COMSPEC = C:\WINDOWS\system32\cmd.exe
JAVA_HOME = C:\Users\ort-user\AppData\Local\Programs\Eclipse Adoptium\jdk-21.0.7.6-hotspot

Looking for ORT configuration in the following file:
        C:\Users\ort-user\.ort\config\config.yml

Looking for analyzer-specific configuration in the following files and directories:
        C:\X-RAY WorX\XRAYWorXBase\.ort.yml
        C:\Users\ort-user\.ort\config\resolutions.yml (does not exist)
The following 26 package manager(s) are enabled:
        Bazel, Bower, Bundler, Cargo, Carthage, CocoaPods, Composer, Conan, GoMod, Gradle Inspector, Maven, NPM, NuGet, PIP, Pipenv, PNPM, Poetry, Pub, SBT, SpdxDocumentFile, Stack, Swift Package Manager, Tycho, Unmanaged, Yarn, Yarn 2+
The following 3 package curation provider(s) are enabled:
        RepositoryConfiguration, DefaultDir, DefaultFile
Analyzing project path:
        C:\X-RAY WorX\XRAYWorXBase
Found 3 NuGet definition file(s) at:
        XRAYWorXBase.Misc\XRAYWorXBase.Misc.csproj
        XRAYWorXBase.Tests\XRAYWorXBase.Tests.csproj
        XRAYWorXBase\XRAYWorXBase.csproj
Found 1 Unmanaged definition file(s) at:
        .
Found in total 4 definition file(s) from the following 2 package manager(s):
        NuGet, Unmanaged
14:22:44.682 [DefaultDispatcher-worker-1] WARN  java.util.List - Failed to get remote metadata for name: 'XRAYWorXBase' version: '1.0.0'. System.Exception: No package metadata found for XRAYWorXBase.1.0.0.
14:22:46.486 [DefaultDispatcher-worker-1] WARN  java.util.List - Failed to get remote metadata for name: 'XRAYWorXBase' version: '1.0.0'. System.Exception: No package metadata found for XRAYWorXBase.1.0.0.
Exception in thread "main" java.lang.IllegalArgumentException: The VcsInfo(type=Subversion, url=svn://192.168.217.10/PC/Trunk/XRAYWorXBase/XRAYWorXBase, revision=7396, path=XRAYWorXBase/XRAYWorXBase) of project 'NuGet::XRAYWorXBase/XRAYWorXBase.csproj:' cannot be found in Repository(vcs=VcsInfo(type=Subversion, url=svn://192.168.217.10/PC/Trunk/XRAYWorXBase, revision=7396, path=XRAYWorXBase), vcsProcessed=VcsInfo(type=Subversion, url=svn://192.168.217.10/PC/Trunk/XRAYWorXBase, revision=7396, path=XRAYWorXBase), nestedRepositories={}, config=RepositoryConfiguration(analyzer=null, excludes=Excludes(paths=[PathExclude(pattern=**/bin/**, reason=BUILD_TOOL_OF, comment=Temporärer Build-Ordner), PathExclude(pattern=**/obj/**, reason=BUILD_TOOL_OF, comment=Temporärer Build-Ordner)], scopes=[]), resolutions=Resolutions(issues=[], ruleViolations=[], vulnerabilities=[]), curations=Curations(packages=[PackageCuration(id=Identifier(type=NuGet, namespace=, name=XRAYWorXBase/XRAYWorXBase.csproj, version=), data=PackageCurationData(comment=null, purl=null, cpe=null, authors=null, concludedLicense=null, description=null, homepageUrl=null, binaryArtifact=null, sourceArtifact=null, vcs=VcsInfoCurationData(type=Subversion, url=, revision=HEAD, path=null), isMetadataOnly=null, isModified=null, declaredLicenseMapping={}, sourceCodeOrigins=null, labels={}))], licenseFindings=[]), packageConfigurations=[], licenseChoices=LicenseChoices(repositoryLicenseChoices=[], packageLicenseChoices=[]), snippetChoices=[])).
        at org.ossreviewtoolkit.model.OrtResult.getFilePathRelativeToAnalyzerRoot(OrtResult.kt:260)
        at org.ossreviewtoolkit.model.OrtResult.getDefinitionFilePathRelativeToAnalyzerRoot(OrtResult.kt:226)
        at org.ossreviewtoolkit.model.config.Excludes.findPathExcludes(Excludes.kt:56)
        at org.ossreviewtoolkit.model.OrtResult.projects_delegate$lambda$21(OrtResult.kt:191)
        at kotlin.SynchronizedLazyImpl.getValue(LazyJVM.kt:86)
        at org.ossreviewtoolkit.model.OrtResult.getProjects(OrtResult.kt:187)
        at org.ossreviewtoolkit.model.OrtResult.isProjectExcluded(OrtResult.kt:638)
        at org.ossreviewtoolkit.model.OrtResult.packages_delegate$lambda$8(OrtResult.kt:140)
        at kotlin.SynchronizedLazyImpl.getValue(LazyJVM.kt:86)
        at org.ossreviewtoolkit.model.OrtResult.getPackages(OrtResult.kt:123)
        at org.ossreviewtoolkit.model.OrtResult.getUncuratedPackages(OrtResult.kt:558)
        at org.ossreviewtoolkit.model.OrtResult.getUncuratedPackages$default(OrtResult.kt:556)
        at org.ossreviewtoolkit.utils.config.OrtResultExtensionsKt.setPackageCurations(OrtResultExtensions.kt:47)
        at org.ossreviewtoolkit.analyzer.Analyzer.analyze(Analyzer.kt:163)
        at org.ossreviewtoolkit.plugins.commands.analyzer.AnalyzeCommand.run(AnalyzeCommand.kt:209)
        at com.github.ajalt.clikt.core.CoreCliktCommandKt.parse(CoreCliktCommand.kt:107)
        at com.github.ajalt.clikt.core.CoreCliktCommandKt.main(CoreCliktCommand.kt:78)
        at com.github.ajalt.clikt.core.CoreCliktCommandKt.main(CoreCliktCommand.kt:90)
        at org.ossreviewtoolkit.cli.OrtMainKt.main(OrtMain.kt:85)

I'm a total newby when it comes to spdx and license forwarding via automatically generated sboms and appreciate any help you could give me.

Best regards

Benjamin

[sschuberth]

You might be running into #5232.

[sschuberth]

@xrayWorker wrote:

As I understand this is still an open issue. Is there a way to give the correct svn-url to ort or a way to tell the analyzer to look locally on my hard drive instead of checking the subversion repository?

[sschuberth]

Is there a way to give the correct svn-url to ort

IIRC it's not about providing the correct URL, but more about ORT's internal logic to determine the right revision to checkout (and in SVN, the tag / branch is part of the URL, in a sense). So I don't think there's a work-around regarding the SVN URL currently.

However, usually you could have tried to use a source artifact URL instead of a repository URL. But the NuGet ecosystem is known to provide no source artifacts usually...

a way to tell the analyzer to look locally on my hard drive

No, that goes a bit into the direction of #2896, which is also not implemented yet.