License Infos for additional packages

[StefanB1177]

Hello everyone,
I use ort to determine the license information from my solution.
This works so far, but we have individual references that are not integrated via a package manager. How can you include this license information (package name, version, type of license) in the report?
Is there somehow a way to say that "Package XY" has the "Apache 2.0" license and is used by the software so that this package then appears in the report?

[sschuberth]

There's currently no definite way to "artificially inject" dependencies into existing analyzer results.

The case is a bit different if you'd not use any package manager at all in your project, then you could either use

• the helper-cli's CreateAnalyzerResultFromPackageListCommand, or
• manually craft SPDX files and use them in combination with the SpdxDocumentFile analyzer
  to generate analyzer results.

Depending on your use-case, it might be easiest to actually write an analyzer plugin that "finds" your additional dependencies. This way they will be added to the usually generated results.

How are those additional dependencies declared for the build system if not via a package manager?

[StefanB1177]

Thanks for the quick reply.
I used the definition via SPDX file. That made it work.

We include the libraries directly via dll as there are no available packages for them.