getting project licenses through oss review toolkit

[alahmm]

Hello, 

recently I wanted to use your tool in order to analyze dependencies in my project and scanning their licenses. 

The analyzer worked perfectly and I got through it the wanted results. 

The scanner shows an error while using it for a python project. The error is: "Could not resolve provenance for 'PIP::requirements.txt:' for source code origins [VCS, ARTIFACT].)". This message is shown in the summary section in the scan-results.json and is categorized as ERROR. I would not excpect that this is an error because the file requirements.txt was provided by me in the project's root directory (and has no provenance).

The dependencies of my project are listed correctly in the scan-results.json. When executing the PDF report (PdfTemplate) the chapter 2 "Project Licenses" is empty (see screenshot). My expectation was that all licenses of my project are listed in this chapter. Is my expectation correct? May there be any connections to the ERROR described above why the chapter is empty?
The third chapter "Dependencies" is correct and lists all relevant dependencies. 

Thank you in advance for your feedback.

[sschuberth]

the file requirements.txt was provided by me in the project's root directory (and has no provenance).

Not sure what you mean by "has no provenance", but requirements.txt file cannot contain any project metadata besides direct dependencies. In particular, they cannot contain a license declared for the project. If you also have no LICENSE file (or similar) in you project, the scanner will also not be ablt to detect any license, which in the end means it would be expected that there are not licenses available for your project only (not taking into account licenses for dependencies of the project).

My expectation was that all licenses of my project are listed in this chapter. Is my expectation correct?

That depends on your definition of "all licenses of my project". In ORT, project licenses are those only for the project, not the sum of licenses for the project and its dependencies.

[alahmm]

Hello,

thank you very much for your unswer. I understood from what you said that i must have a lICENSE file in my project to get the Licenses of my project from it in the second capitel in the pdf report. I did that but i still get an empty content of this capitel, is that what it was meant?

Thank you for your unswer.

sincerely