Bazel: how to handle a module without version ?

[nnobelis]

Today I had to process a MODULE.bazel file with ORT containing:

bazel_dep(name = "cifuzz", dev_dependency = True)
archive_override(
    module_name = "cifuzz",
    integrity = "sha256-dvNEEojTfcd2mLXLEQPEZ4i+jDU6dFMccSaBHZLDMpI=",
    strip_prefix = "cifuzz-bazel-90f42822b6da3405a99308757b344c0d57da0c36",
    urls = ["https://github.com/CodeIntelligenceTesting/cifuzz-bazel/archive/90f42822b6da3405a99308757b344c0d57da0c36.zip"],
)

And ORT does not like this file:

java.lang.IllegalArgumentException: Missing version in 'bazel_dep' directive
	at org.ossreviewtoolkit.plugins.packagemanagers.bazel.Parser.parseBazelDepDirective(StarlarkParser.kt:219)
	at org.ossreviewtoolkit.plugins.packagemanagers.bazel.Parser.parse(StarlarkParser.kt:250)
	at org.ossreviewtoolkit.plugins.packagemanagers.bazel.Bazel.resolveDependencies(Bazel.kt:203)
	at org.ossreviewtoolkit.analyzer.PackageManager.resolveDependencies(PackageManager.kt:324)
	at org.ossreviewtoolkit.analyzer.PackageManagerRunner$run$3.invokeSuspend(Analyzer.kt:361)
	at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:33)
	at kotlinx.coroutines.DispatchedTask.run(DispatchedTask.kt:100)
	at kotlinx.coroutines.internal.LimitedDispatcher$Worker.run(LimitedDispatcher.kt:124)

However, after looking at the specs, a dependency without version is something allowed.

So IMO ORT should not hard fail anymore and accept this dependency, maybe with " " as version value as the it is the default in Bazel specs.
However isn't a empty/blank version string going to cause problem in various components from ORT ?

[sschuberth]

To clarify, does the empty version occur in a project, or a package?

[sschuberth]

However isn't a empty/blank version string going to cause problem in various components from ORT ?

Potentially yes. But I wonder whether we could simply fall back to e.g. the integrity in case of an empty version.

[nnobelis]

Yes I thought too, but an archive_override may not always be defined...

[nnobelis]

But yeah, let's say that they put, in this case, version="90f42822b6da3405a99308757b344c0d57da0c36".

Is it ok for ORT or must the version be a semantic one ?

[sschuberth]

There is no strict need for the version to be semantic.