Sebastian Schuberth

Sbt 1.4 started to [bundle](https://www.scala-sbt.org/1.x/docs/sbt-1.4-Release-Notes.html#sbt-dependency-graph+is+in-sourced) the previously external [sbt-dependency-graph](https://github.com/sbt/sbt-dependency-graph) plugin, so that seems to be the new way to go to query dependencies. Unfortunately, the plugin still seem to [not...

Quick recap, [Sbt by now uses Coursier instead of Ivy](https://github.com/sbt/sbt/discussions/7156#discussioncomment-5066187) for dependency resolution, and [Coursier can produce JSON output](https://github.com/coursier/coursier/issues/575#issuecomment-407550626) for dependencies.

As a test for a new / improved implementation, we should ensure that analyzing https://github.com/orbeon/orbeon-forms/tree/279b983234362e181be4d6c93eed90253d15045c as used by https://github.com/nordic-institute/misp2 works.

@bennati please check whether the issue is also reproducible with ScanCode alone.

This can be solved once https://github.com/oss-review-toolkit/ort/issues/8457 is done by then interpreting the new `from_file` field.

> Those obviously are errors that should be fixed/deleted from the repository, but I think ORT also should gracefully ignore those files instead of trying to unpack 0 byte files....

I guess https://github.com/oss-review-toolkit/ort/pull/8303 helps?

@timo-HERE could you please check whether the issue is resolved for you with the latest `main`? I.e. 0-byte artifacts are still not skipped explicitly, but coming across them should now...

Feel free to reopen if the issue persists.

> @nnobelis we are currently evaluating ORT, and ran into the same "issue". @brueggenthies-ams do you have another, maybe more convincing, use-case than the mentioned example of a Python `requirements.txt`...