Scanning of local directories without downloading from VCS?

[th]

Hi,

is it possible to have ort scan in the local file tree instead of downloading packages from git?

Both for efficiency reasons (I already have a full checkout) and because I have a few projects in mind where during the build stage additional source code is pulled in from elsewhere without being present in the git repository or the package manager's project files.

[sschuberth]

is it possible to have ort scan in the local file tree instead of downloading packages from git?

Hmm, I guess this is asking something different than what #8803 and related issues are about? I sounds like you're after not downloading the source code of transitive dependencies, as you already have it locally for some reason. Is my understanding correct?

additional source code is pulled in from elsewhere without being present in the git repository or the package manager's project files.

Ok, this now sounds yet different, as if you want to "artifically" declare packages that ORT would otherwise not discover, to get these scanned additionally. For that use-case, the CreateAnalyzerResultFromPackageListCommand helper-cli command could be a solution.

[th]

1. Yes, I have cloned the whole repo built it already, so I have everything present.
2. Thanks! I didn't really register the helper CLI, yet, although I seem to have downloaded it, as well.

[sschuberth]

Yes, I have cloned the whole repo built it already, so I have everything present.

Hmm, usually building does not pull in the source code of transitive dependencies, though. What language / build system / package manager are we talking about?

[th]

You're right, I got confused. The source code cargo fetches isn't placed in the project dir, but in $CARGO_HOME/registry/. So it doesn't easily help for scanning a single project. It was just an idea to shorten the download times.