Take only specified Maven profiles into account instead of the default one

[sschuberth]

Currently, ORT only considers dependencies of the Maven profile that is activated by default for the platform / environment ORT runs on. Ideally, ORT would instead enumerate all profiles and analyze each one separately. This could be modeled by "virtual" projects that are a combination of project name and profile name: A project "foo" with profiles "p1" and "p2" could be modeled as two projects "foo-p1" and "foo-p2", each with potentially different dependencies.

[uszeiss]

If I understand the issue description correctly, the current ORT version does not allow me to specify a Maven profile to be used for the analysis. Only the default profile will be used. Is this correct?

[sschuberth]

Yes, that is correct.

[sschuberth]

One idea how to address this would be to allow .ort.yml to specify additional package-manager-specific information, like the Maven profile to use.

[sschuberth]

A thought about the implementation: Conceptually, profile selection could work via something like "profile excludes" similar to scope / path excludes, in the sense that also dependencies from excluded profiles do not disappear completely, but are only marked as excluded.