best solution to scan a project separately and combine results to a final report about ort HOT 6 CLOSED

Let's say I want to perform code scans on different parts of a project separately and then merge the final results. What would be the best approach for achieving this with ORT?

We've had some (oral) discussions about this quite some time ago in our ORT Community meetings in the context of this PR, but came to the (preliminary) conclusion that it's too hard to get right for all use-cases, and thus the idea to implement something like this stalled.

from ort.

Re-scanning the entire project can be time-consuming

One idea is to scan packages one-by-one in advance to populate the scan storage (you should set up a database for that beforehand), so the "real" scan does through smoothly.

from ort.

how is it mapped among binary artifacts ,source artifacts and source repository.

That depends a bit on your configuration of source code origins:

In general, ORT does not download binary artifacts, but only source artifacts or source code from VCS. Which of the latter two (and in which order) is determined by the above setting, and any errors messages refer to getting code from that configured origin(s).

from ort.

fyi, I also want to know how the version control system is worked , I can see it from logs that ,sometimes Could not fetch only revision, some times Could not find any revision candidates for package , some times Could not resolve revision for package , and how is it mapped among binary artifacts ,source artifacts and source repository.

from ort.

@ChenZhaobin please also stick to one topic per issue, and consider starting a discussion instead if you're not actually reporting a bug or requesting a feature.

from ort.

understood, thanks for the quick help.

from ort.