Outdated or Inaccessible VCS

[randygeyer]

Hi ORT team,

What's the best way to deal with the types of scanner failures below due to old or inaccessible VCS systems? I'd prefer to simply skip the scan when the Analyzer resolves these packages to outdated VCS systems like SourceForge, since it takes the scanner/downloader 30-60s to timeout on them. Assuming there's no workaround to locate the source, is there a way to configure the scanner to skip them, or skip known outdated/bad VCS urls? I can work around this by checking the Analyzer provenance prior to scanning, but would like to know the approved solution.

Please let me know if I'm missing something more fundamental like configuring additional VCS providers and/or curations prior to scanning.

Finally, is there a known list of VCS urls that will fail (no longer exist), for all package managers, not just Java/Maven?

Thanks!

Resolution of VCS failed with:
IOException: Could not determine VCS for type 'cvs' and URL ssh://pserver:[email protected]:/cvsroot/jfreechart/jcommon.]```

[sschuberth]

Assuming there's no workaround to locate the source

There is. We call them "package curations" as they are able to curate metadata errors, like the declared VCS location, for packages. See the docs and real-life use-cases.

Finally, is there a known list of VCS urls that will fail (no longer exist), for all package managers, not just Java/Maven?

It's implied by existing VCS curations: Simply put, any VCS URL for which there is a curation would fail otherwise.

[randygeyer]

Yeah, I knew about ort-config and curations, but the ones I keep encountering don't have curations there, like the one I provided above. Should I be using the other curation sources for better coverage?

[sschuberth]

Well, you could try with enabling other curation sources, but ideally you'd just create a new curation and contribute it to the ort-config ones. Maintaining curation is a community effort (same goes for ClearlyDefined and other sources).

[sschuberth]

If you can share for which version of jfreechart you're trying to download the source code, I could probably quickly create a public curation for your reference.