Get the actual location of the license text in the source code of the package

[mennaElnemr9]

In the ResolvedLicense.kt class there is a list of locations where the license text possibly exists in the source code, but what If I want the exact location of the license text in the source code, Is there a way to get the exact license text file location inside the source code?

[sschuberth]

Are you looking for a way to programmatically get the license finding from Kotlin / Java code, or do you want to post-process license findings from an ORT result? The latter contains the license findings incl. line number like shown in this dummy example.

Also, the static HTML report contains links to the exact original source code location, if feasible.

But be advised that the line statements refer to the matched text by the scanner, which is not necessarily the full license text.

[mennaElnemr9]

I want to programmatically get the license text location an make sure that the license text is present in the source code, There are some false positives with the locations of every license , sometimes the result is that a specific license exists in the package but the package doesn't include the full license text as whole.

So is there a way to make sure if the license text already exists in the source code of the package or not , and If so how to how to get the exact location of it ?

[sschuberth]

I want to programmatically get the license text location an make sure that the license text is present in the source code

That check does not make sense, IMO. The text found by e.g. ScanCode is by definition present in the source code.

However, the found / matched text may not be the full license text, like you said.

So is there a way to make sure if the license text already exists in the source code of the package or not , and If so how to how to get the exact location of it ?

I'm not sure whether you fully understand how ScanCode works here yet. What ScanCode gives you is the location (file and start / end line numbers) of the text block that triggered a ScanCode finding, and ORT records that finding. Additionally, ScanCode can extract the lines of text for you in its raw results, but ORT does not make use of that feature.

Anyway, all you get is the piece of text that triggered a finding. That may or may not be (an excerpt of) a real / full license text. If you goal is to compare ScanCode's matched text (and determined license name) to the original text for that license (e.g. in a side-by-side diff for human review), then you'd need to post-process ORT's scan-result for findings and have access to the scanned source code to look up the file and line numbers from the findings in the source code and extract the matched text. Then you need to also get the original license texts (maybe from https://scancode-licensedb.aboutcode.org/) and finally compare the extracted matched text to the original license text.

[jens-erdmann]

Hi there,

there might be some confusion here regarding workflow and procedure:
@mennaElnemr9 right now is working on our internal document templates to further automate and integrate. For this she is exploring the ort data model and the different aspects that can be presented in a report.
One specific aspect is the actual license text. Our legal council raised the requirement to provide a reference to the actual license text specific to the project (or more than one if there are more licenses present). AFAIK sometimes this license text can be just a copy of a template and sometimes this template has to be modified to be valid. The point is, that we need a reference to the complete license text of the detected license.
But maybe we have to refine this requirement with our legal council instead. Right now @mennaElnemr9 was just looking at the data model and was just trying to find "the one" license text, if that makes sense.

[sschuberth]

Our legal council raised the requirement to provide a reference to the actual license text specific to the project

That can be achieved via the helper methods provided to reporter templates, see e.g. the NOTICE_DEFAULT.ftl template.

[fviernau]

The only file content ORT stores is the content of all files matching the license file patterns [1].
These can be configured by the ORT configuration (~/ort/config/config.yml) [1].
So, file locations (path, start_line, end_line) can be resolved via ORT to the actual file content at that position only
for files which actually got stored, because they matched the above patterns. This is IIRC what the "helper methods" mentioned by @sschuberth above can do.

[1] https://github.com/oss-review-toolkit/ort/blob/62e90ada6633cb060f339f01b058eb0e376af3c6/model/src/main/kotlin/config/LicenseFilePatterns.kt

[2]

ort/model/src/main/kotlin/config/OrtConfiguration.kt

Line 80 in 62e90ad

val licenseFilePatterns: LicenseFilePatterns = LicenseFilePatterns.DEFAULT,