Identifictations added to FossID

[maxilutz98]

Hello,

I currently try to set up ORT for a one embedded C project.
We plan to get some third party deliveries which will be used in our software. We would like to use the information in SPDX files, which we expect to be delivered together with the 3rd party artifacts, to identify the files in FossID with assigning copyright and license information.

Since the SPDX files contain the file hashes and paths, e.g. https://github.com/spdx/spdx-examples/blob/master/software/example1/spdx2.2/example1.spdx#L28, the files are recognizable. FossID itself does not create a relation between the SPDX files of the scanned repository and its files.
ORT seems to have some API calls implemented to add license identifications and mark files as identified but I don't see a usage of these calls in the ORT code yet.

Is there already a way to insert the information from analyzer into the FossID scanner?

[sschuberth]

@nnobelis can you assist here?

[nnobelis]

@maxilutz98 These API calls will be used by the snippet choice feature: https://github.com/oss-review-toolkit/ort/blob/main/website/docs/configuration/snippet-choice.md, hopefully going to be merge in the coming month.

Unfortunately, these calls are not currently used by any other part of ORT, especially not during the Analyzer phase: FossID communication is currently only done during the Scanner phase.

Your requirements make IMO sense, although I don't now how this information about SPDX FileName and LicenseConcluded could be passed by ORT to the FossID scanner.

@sschuberth Feel free to share your opinion.

[sschuberth]

Unfortunately, these calls are not currently used by any other part of ORT, especially not during the Analyzer phase: FossID communication is currently only done during the Scanner phase.

I guess that somewhat relates to #4088?