oss-review-toolkit · Feb 13, 2025 · Feb 13, 2025 · Feb 13, 2025 · Feb 13, 2025 · Feb 13, 2025
diff --git a/Dockerfile b/Dockerfile
@@ -582,8 +582,8 @@ ENV PATH=$PATH:/opt/ort/bin
 USER $USER
 WORKDIR $HOME
 
-# Ensure that the ORT data directory exists to be able to mount the config into it with correct permissions.
-RUN mkdir -p "$HOME/.ort"
+# Ensure that these directories exist in the container to be able to mount directories from the host into them with correct permissions.
+RUN mkdir -p "$HOME/.ort" "$HOME/.gradle"
 
 ENTRYPOINT ["/opt/ort/bin/ort"]
 
@@ -598,7 +598,7 @@ ENV PATH=$PATH:/opt/ort/bin
 USER $USER
 WORKDIR $HOME
 
-# Ensure that the ORT data directory exists to be able to mount the config into it with correct permissions.
-RUN mkdir -p "$HOME/.ort"
+# Ensure that these directories exist in the container to be able to mount directories from the host into them with correct permissions.
+RUN mkdir -p "$HOME/.ort" "$HOME/.gradle"
 
 ENTRYPOINT ["/opt/ort/bin/ort"]
diff --git a/analyzer/src/main/kotlin/Analyzer.kt b/analyzer/src/main/kotlin/Analyzer.kt
@@ -65,7 +65,7 @@ class Analyzer(private val config: AnalyzerConfiguration, private val labels: Ma
 
     /**
      * Find files recognized by any of [packageManagers] inside [absoluteProjectPath]. The [repositoryConfiguration] is
-     * taken into account, e.g. for path excludes and packaga manager options. Instantiate only those package managers
+     * taken into account, e.g. for path excludes and package manager options. Instantiate only those package managers
      * that have matching files and return the latter as part of [ManagedFileInfo].
      */
     @JvmOverloads

diff --git a/docker/versions.dockerfile b/docker/versions.dockerfile
@@ -8,7 +8,7 @@ ARG COMPOSER_VERSION=2.8.4
 ARG CONAN_VERSION=1.66.0
 ARG DART_VERSION=2.18.4
 ARG DOTNET_VERSION=6.0
-ARG GO_VERSION=1.23.5
+ARG GO_VERSION=1.24.0
 ARG HASKELL_STACK_VERSION=2.13.1
 ARG JAVA_VERSION=21
 ARG LICENSEE_VERSION=9.18.0

diff --git a/downloader/src/main/kotlin/VersionControlSystem.kt b/downloader/src/main/kotlin/VersionControlSystem.kt
@@ -24,7 +24,6 @@ import java.io.IOException
 
 import org.apache.logging.log4j.kotlin.logger
 
-import org.ossreviewtoolkit.downloader.VersionControlSystemFactory.Companion.ALL
 import org.ossreviewtoolkit.model.Package
 import org.ossreviewtoolkit.model.VcsInfo
 import org.ossreviewtoolkit.model.VcsType
@@ -43,7 +42,7 @@ import org.semver4j.Semver
 abstract class VersionControlSystem : Plugin {
     companion object {
         private fun getAllVcsByPriority(configs: Map<String, PluginConfig>) =
-            ALL.map { (id, factory) ->
+            VersionControlSystemFactory.ALL.map { (id, factory) ->
                 val config = configs[id] ?: PluginConfig()
                 factory.create(config)
             }.sortedByDescending {

diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
@@ -7,7 +7,7 @@ gitSemverPlugin = "0.15.0"
 graalVmNativeImagePlugin = "0.10.5"
 ideaExtPlugin = "1.1.10"
 kotlinPlugin = "2.1.10"
-ksp = "2.1.10-1.0.29"
+ksp = "2.1.10-1.0.30"
 mavenPublishPlugin = "0.30.0"
 reproducibleBuildsPlugin = "1.0"
 versionsPlugin = "0.52.0"
@@ -37,7 +37,7 @@ jgit = "7.1.0.202411261347-r"
 jiraRestClient = "6.0.1"
 jruby = "9.4.12.0"
 jslt = "0.1.14"
-jsonSchemaValidator = "1.5.5"
+jsonSchemaValidator = "1.5.6"
 kaml = "0.72.0"
 kotest = "5.9.1"
 kotlinPoet = "2.0.0"
@@ -52,18 +52,18 @@ logback = "1.5.16"
 maven = "3.9.9"
 mavenResolver = "1.9.22"
 mockk = "1.13.14"
-mordant = "3.0.1"
+mordant = "3.0.2"
 okhttp = "4.12.0"
 postgres = "42.7.5"
 postgresEmbedded = "1.1.0"
 reflections = "0.10.2"
 retrofit = "2.11.0"
-s3 = "2.30.16"
+s3 = "2.30.21"
 saxonHe = "12.5"
-scanoss = "0.9.0"
+scanoss = "0.10.0"
 semver4j = "5.6.0"
 slf4j = "2.0.16"
-springCore = "6.2.2"
+springCore = "6.2.3"
 svnkit = "1.10.11"
 sw360Client = "17.0.1-m2"
 wiremock = "3.12.0"

diff --git a/integrations/completions/ort-completion.bash b/integrations/completions/ort-completion.bash
@@ -115,6 +115,10 @@ _ort() {
         _ort_notify $(( i + 1 ))
         return
         ;;
+      plugins)
+        _ort_plugins $(( i + 1 ))
+        return
+        ;;
       report)
         _ort_report $(( i + 1 ))
         return
@@ -176,7 +180,7 @@ _ort() {
     "--help")
       ;;
     *)
-      COMPREPLY=($(compgen -W 'advise analyze compare config download evaluate migrate notify report requirements scan upload-curations upload-result-to-postgres upload-result-to-sw360' -- "${word}"))
+      COMPREPLY=($(compgen -W 'advise analyze compare config download evaluate migrate notify plugins report requirements scan upload-curations upload-result-to-postgres upload-result-to-sw360' -- "${word}"))
       ;;
   esac
 }
@@ -1054,6 +1058,61 @@ _ort_notify() {
   esac
 }
 
+_ort_plugins() {
+  local i=$1
+  local in_param=''
+  local fixed_arg_names=()
+  local vararg_name=''
+  local can_parse_options=1
+
+  while [[ ${i} -lt $COMP_CWORD ]]; do
+    if [[ ${can_parse_options} -eq 1 ]]; then
+      case "${COMP_WORDS[$i]}" in
+        --)
+          can_parse_options=0
+          (( i = i + 1 ));
+          continue
+          ;;
+        --types)
+          __skip_opt_eq
+          (( i = i + 1 ))
+          [[ ${i} -gt COMP_CWORD ]] && in_param='--types' || in_param=''
+          continue
+          ;;
+        -h|--help)
+          __skip_opt_eq
+          in_param=''
+          continue
+          ;;
+      esac
+    fi
+    case "${COMP_WORDS[$i]}" in
+      *)
+        (( i = i + 1 ))
+        # drop the head of the array
+        fixed_arg_names=("${fixed_arg_names[@]:1}")
+        ;;
+    esac
+  done
+  local word="${COMP_WORDS[$COMP_CWORD]}"
+  if [[ "${word}" =~ ^[-] ]]; then
+    COMPREPLY=($(compgen -W '--types -h --help' -- "${word}"))
+    return
+  fi
+
+  # We're either at an option's value, or the first remaining fixed size
+  # arg, or the vararg if there are no fixed args left
+  [[ -z "${in_param}" ]] && in_param=${fixed_arg_names[0]}
+  [[ -z "${in_param}" ]] && in_param=${vararg_name}
+
+  case "${in_param}" in
+    "--types")
+      ;;
+    "--help")
+      ;;
+  esac
+}
+
 _ort_report() {
   local i=$1
   local in_param=''

diff --git a/integrations/completions/ort-completion.fish b/integrations/completions/ort-completion.fish
@@ -3,7 +3,7 @@
 
 
 ### Setup for ort
-set -l ort_subcommands 'advise analyze compare config download evaluate migrate notify report requirements scan upload-curations upload-result-to-postgres upload-result-to-sw360'
+set -l ort_subcommands 'advise analyze compare config download evaluate migrate notify plugins report requirements scan upload-curations upload-result-to-postgres upload-result-to-sw360'
 
 ## Options for ort
 complete -c ort -n "not __fish_seen_subcommand_from $ort_subcommands" -l config -s c -r -F -d 'The path to a configuration file.'
@@ -135,6 +135,14 @@ complete -c ort -n "__fish_seen_subcommand_from notify" -l label -s l -r -d 'Set
 complete -c ort -n "__fish_seen_subcommand_from notify" -s h -l help -d 'Show this message and exit'
 
 
+### Setup for plugins
+complete -c ort -f -n __fish_use_subcommand -a plugins -d 'Print information about the installed ORT plugins.'
+
+## Options for plugins
+complete -c ort -n "__fish_seen_subcommand_from plugins" -l types -r -d 'A comma-separated list of plugin types to show.'
+complete -c ort -n "__fish_seen_subcommand_from plugins" -s h -l help -d 'Show this message and exit'
+
+
 ### Setup for report
 complete -c ort -f -n __fish_use_subcommand -a report -d 'Present Analyzer, Scanner and Evaluator results in various formats.'
 

diff --git a/integrations/completions/ort-completion.zsh b/integrations/completions/ort-completion.zsh
@@ -120,6 +120,10 @@ _ort() {
         _ort_notify $(( i + 1 ))
         return
         ;;
+      plugins)
+        _ort_plugins $(( i + 1 ))
+        return
+        ;;
       report)
         _ort_report $(( i + 1 ))
         return
@@ -181,7 +185,7 @@ _ort() {
     "--help")
       ;;
     *)
-      COMPREPLY=($(compgen -W 'advise analyze compare config download evaluate migrate notify report requirements scan upload-curations upload-result-to-postgres upload-result-to-sw360' -- "${word}"))
+      COMPREPLY=($(compgen -W 'advise analyze compare config download evaluate migrate notify plugins report requirements scan upload-curations upload-result-to-postgres upload-result-to-sw360' -- "${word}"))
       ;;
   esac
 }
@@ -1059,6 +1063,61 @@ _ort_notify() {
   esac
 }
 
+_ort_plugins() {
+  local i=$1
+  local in_param=''
+  local fixed_arg_names=()
+  local vararg_name=''
+  local can_parse_options=1
+
+  while [[ ${i} -lt $COMP_CWORD ]]; do
+    if [[ ${can_parse_options} -eq 1 ]]; then
+      case "${COMP_WORDS[$i]}" in
+        --)
+          can_parse_options=0
+          (( i = i + 1 ));
+          continue
+          ;;
+        --types)
+          __skip_opt_eq
+          (( i = i + 1 ))
+          [[ ${i} -gt COMP_CWORD ]] && in_param='--types' || in_param=''
+          continue
+          ;;
+        -h|--help)
+          __skip_opt_eq
+          in_param=''
+          continue
+          ;;
+      esac
+    fi
+    case "${COMP_WORDS[$i]}" in
+      *)
+        (( i = i + 1 ))
+        # drop the head of the array
+        fixed_arg_names=("${fixed_arg_names[@]:1}")
+        ;;
+    esac
+  done
+  local word="${COMP_WORDS[$COMP_CWORD]}"
+  if [[ "${word}" =~ ^[-] ]]; then
+    COMPREPLY=($(compgen -W '--types -h --help' -- "${word}"))
+    return
+  fi
+
+  # We're either at an option's value, or the first remaining fixed size
+  # arg, or the vararg if there are no fixed args left
+  [[ -z "${in_param}" ]] && in_param=${fixed_arg_names[0]}
+  [[ -z "${in_param}" ]] && in_param=${vararg_name}
+
+  case "${in_param}" in
+    "--types")
+      ;;
+    "--help")
+      ;;
+  esac
+}
+
 _ort_report() {
   local i=$1
   local in_param=''

diff --git a/model/src/main/kotlin/licenses/LicenseInfoResolver.kt b/model/src/main/kotlin/licenses/LicenseInfoResolver.kt
@@ -258,7 +258,7 @@ class LicenseInfoResolver(
             val directory = (provenance as? RepositoryProvenance)?.vcsInfo?.path.orEmpty()
             val rootLicenseFiles = pathLicenseMatcher.getApplicableLicenseFilesForDirectories(
                 relativeFilePaths = archiveDir.walk().filter { it.isFile }.mapTo(mutableSetOf()) {
-                    it.toRelativeString(archiveDir)
+                    it.relativeTo(archiveDir).invariantSeparatorsPath
                 },
                 directories = listOf(directory)
             ).getValue(directory)

diff --git a/model/src/main/kotlin/utils/DependencyGraphBuilder.kt b/model/src/main/kotlin/utils/DependencyGraphBuilder.kt
@@ -326,9 +326,9 @@ class DependencyGraphBuilder<D>(
         val dependencies = dependencyHandler.dependenciesFor(dependency)
         if (ref.dependencies.size != dependencies.size) return false
 
-        val dependencies1 = ref.dependencies.map { dependencyIds[it.pkg] }
+        val dependencies1 = ref.dependencies.mapTo(mutableSetOf()) { dependencyIds[it.pkg] }
         val dependencies2 = dependencies.associateBy { dependencyHandler.identifierFor(it) }
-        if (!dependencies2.keys.containsAll(dependencies1)) return false
+        if (dependencies1 != dependencies2.keys) return false
 
         return ref.dependencies.all { refDep ->
             dependencies2[dependencyIds[refDep.pkg]]?.let { dependencyTreeEquals(refDep, it) } == true

diff --git a/model/src/main/resources/reference.yml b/model/src/main/resources/reference.yml
@@ -237,10 +237,10 @@ ort:
         options:
           # Command line options that affect the ScanCode output. If changed, stored scan results that were created with
           # different options are not reused.
-          commandLine: '--copyright --license --info --strip-root --timeout 300'
+          commandLine: '--copyright,--license,--info,--strip-root,--timeout,300'
 
           # Command line options that do not affect the ScanCode output.
-          commandLineNonConfig: '--processes 4'
+          commandLineNonConfig: '--processes,4'
 
           # Use per-file license findings instead of per-line ones.
           preferFileLicense: false

diff --git a/model/src/test/kotlin/config/OrtConfigurationTest.kt b/model/src/test/kotlin/config/OrtConfigurationTest.kt
@@ -241,8 +241,8 @@ class OrtConfigurationTest : WordSpec({
                 config shouldNotBeNull {
                     get("ScanCode") shouldNotBeNull {
                         options shouldContainExactly mapOf(
-                            "commandLine" to "--copyright --license --info --strip-root --timeout 300",
-                            "commandLineNonConfig" to "--processes 4",
+                            "commandLine" to "--copyright,--license,--info,--strip-root,--timeout,300",
+                            "commandLineNonConfig" to "--processes,4",
                             "preferFileLicense" to "false",
                             "minVersion" to "3.2.1-rc2",
                             "maxVersion" to "32.0.0"

diff --git a/model/src/test/kotlin/licenses/ResolvedLicenseInfoTest.kt b/model/src/test/kotlin/licenses/ResolvedLicenseInfoTest.kt
@@ -38,7 +38,6 @@ import org.ossreviewtoolkit.model.TextLocation
 import org.ossreviewtoolkit.model.UnknownProvenance
 import org.ossreviewtoolkit.model.config.CopyrightGarbage
 import org.ossreviewtoolkit.model.config.LicenseFilePatterns
-import org.ossreviewtoolkit.model.licenses.LicenseView.Companion.CONCLUDED_OR_DECLARED_AND_DETECTED
 import org.ossreviewtoolkit.utils.ort.ProcessedDeclaredLicense
 import org.ossreviewtoolkit.utils.spdx.SpdxExpression
 import org.ossreviewtoolkit.utils.spdx.SpdxLicense
@@ -97,7 +96,7 @@ class ResolvedLicenseInfoTest : WordSpec({
             )
 
             val effectiveLicense = RESOLVED_LICENSE_INFO.effectiveLicense(
-                CONCLUDED_OR_DECLARED_AND_DETECTED,
+                LicenseView.CONCLUDED_OR_DECLARED_AND_DETECTED,
                 choices
             )
 
@@ -141,7 +140,7 @@ class ResolvedLicenseInfoTest : WordSpec({
             timeout = 1.seconds
         ) {
             runCancellable {
-                COMPUTATION_HEAVY_RESOLVED_LICENSE_INFO.effectiveLicense(CONCLUDED_OR_DECLARED_AND_DETECTED)
+                COMPUTATION_HEAVY_RESOLVED_LICENSE_INFO.effectiveLicense(LicenseView.CONCLUDED_OR_DECLARED_AND_DETECTED)
             }
         }
     }
@@ -229,10 +228,7 @@ private val RESOLVED_LICENSE_INFO: ResolvedLicenseInfo by lazy {
  * effectiveLicense(), rather computation-heavy.
  */
 private val COMPUTATION_HEAVY_RESOLVED_LICENSE_INFO: ResolvedLicenseInfo by lazy {
-    val licensesWithoutChoice = SpdxLicense.values()
-        .toList()
-        .subList(0, 200)
-        .map { SpdxExpression.parse(it.id) }
+    val licensesWithoutChoice = SpdxLicense.entries.subList(0, 200).map { SpdxExpression.parse(it.id) }
 
     // Expressions taken from a real world scan with swapped identifiers.
     val licensesWithChoice = listOf(