Trouble running the detection

[sschuberth]

I'm having trouble running the tool on Windows. I've downloaded and extracted the distribution Tarball and changed to the contained directory. When trying to detect dependencies of a Maven project I get:

C:\Users\me\Downloads\component-detection>dotnet run --project .\Microsoft.ComponentDetection scan --SourceDirectory C:\Users\me\Development\Maven
C:\Users\me\Downloads\component-detection\Microsoft.ComponentDetection(1,1): error MSB4025: The project file could not be loaded. Data at the root level is invalid. Line 1, position 1.

The build failed. Fix the build errors and run again.

What am I doing wrong in the call? Is "the project file" really the C:\Users\me\Development\Maven\pom.xml as I would expect?

[JamieMagee]

This is definitely an area where we can improve the first run experience, and I hope to merge #37 soon.

The --project flag for dotnet run expects a .csproj file i.e. source code. The published bits are already compiled. The command you're looking for is dotnet ./Microsoft.ComponentDetection.dll

dotnet .\Microsoft.ComponentDetection.dll help
Microsoft.ComponentDetection 1.0.8+build.22.70c149cd3c2c4f41e14d05d25517f1251b7ece27
Copyright © Microsoft Corporation. All rights reserved.

  scan              Scans components

  list-detectors    Lists available detectors

  help              Display more information on a specific command.

  version           Display version information.

Execution finished, status: 0.
Process terminating.

[sschuberth]

Thanks, I'm able to run the tool now, but the Maven project in C:\Users\me\Development\Maven is not recognized. Do I first need to apply some plugin in the project's pom.xml?

[JamieMagee]

It's not required. Can you share your pom.xml so I can help debug this more?

[sschuberth]

Sure, I was using https://github.com/oss-review-toolkit/ort/blob/master/analyzer/src/funTest/assets/projects/synthetic/maven/lib/pom.xml for testing.

[JamieMagee]

I am able to get an output when scanning that directory. Do you have the mvn CLI installed? We use it to generate a list of dependencies

https://github.com/microsoft/component-detection/blob/2956bdb4cd22eb58292801afcae0ea10d269f619/src/Microsoft.ComponentDetection.Detectors/maven/MvnCliComponentDetector.cs#L35-L39

Here's the output from my scan:

maven-log.txt ScanManifest_20220201085710.json.txt

EDIT: It looks like there is a bug in our parsing though, as I'm not getting the child project dependencies. I am getting a log message:

[VERBOSE] Ignoring pom.xml at /home/jamie/code/ort/analyzer/src/funTest/assets/projects/synthetic/maven/app/pom.xml, as it has a parent pom.xml that will be processed at /home/jamie/code/ort/analyzer/src/funTest/assets/projects/synthetic/maven\pom.xml .
[VERBOSE] Ignoring pom.xml at /home/jamie/code/ort/analyzer/src/funTest/assets/projects/synthetic/maven/lib/pom.xml, as it has a parent pom.xml that will be processed at /home/jamie/code/ort/analyzer/src/funTest/assets/projects/synthetic/maven\pom.xml .

But the dependencies from app and lib are not registered in the final output.

EDIT 2: We're only scanning the top-level project, and expecting it to have a module for each of the child projects.