ort icon indicating copy to clipboard operation
ort copied to clipboard

Provide a small self-contained analyzer-only distribution of ORT

Open sschuberth opened this issue 7 months ago • 1 comments

For cases where an ORT pipeline is run in a central CI system or as part of a SaaS solution based on ORT Server, the problem arises that analysis is not run in the exact environment where the build happens / the distribution is being created, resulting in various problems like

  • necessary build environment variables / properties not being set up,
  • another OS being used and thus platform-specific dependencies being reported incorrectly (also see https://github.com/oss-review-toolkit/ort/issues/4013),
  • full access to proprietary / confidential project source code has to be provided,
  • finally, it can also be security risk to run the analyzer (which could execute arbitrary scripts as part of replaying the build) in a central environment that has access to all source code.

To work around these issues, the idea is for development team to run only the ORT analyzer locally / in their exact build environment, and then pass the created ORT result to the central CI system / ORT Server (also see these issues) where it gets processed further in the "usual" pipeline steps.

sschuberth avatar Apr 10 '25 09:04 sschuberth

Work on this has been started in https://github.com/oss-review-toolkit/ort/pull/10048.

sschuberth avatar Apr 10 '25 09:04 sschuberth