ort
ort copied to clipboard
Provide a small self-contained analyzer-only distribution of ORT
For cases where an ORT pipeline is run in a central CI system or as part of a SaaS solution based on ORT Server, the problem arises that analysis is not run in the exact environment where the build happens / the distribution is being created, resulting in various problems like
- necessary build environment variables / properties not being set up,
- another OS being used and thus platform-specific dependencies being reported incorrectly (also see https://github.com/oss-review-toolkit/ort/issues/4013),
- full access to proprietary / confidential project source code has to be provided,
- finally, it can also be security risk to run the analyzer (which could execute arbitrary scripts as part of replaying the build) in a central environment that has access to all source code.
To work around these issues, the idea is for development team to run only the ORT analyzer locally / in their exact build environment, and then pass the created ORT result to the central CI system / ORT Server (also see these issues) where it gets processed further in the "usual" pipeline steps.
Work on this has been started in https://github.com/oss-review-toolkit/ort/pull/10048.