tern 2.2.0 with scancode plugin doesn't list packages anymore

[amallayev]

debian_scancode.json.txt
Hello,

tern 2.1.0 with scancode plugin execution used to produce package listing for PhotonOS, Ubuntu, Debian, SuSE and possibly some others.

With tern 2.2.0 this functionality was removed. Can you please confirm if this was intentional? Just making sure that it is not a bug.

[nishakm]

Hello,

tern 2.1.0 with scancode plugin execution used to produce package listing for PhotonOS, Ubuntu, Debian, SuSE and possibly some others.

With tern 2.2.0 this functionality was removed. Can you please confirm if this was intentional? Just making sure that it is not a bug.

That's interesting. IIRC, v2.2.0 should have added functionality for scancode to find packages. I will check.
Previously, you needed to run tern in default mode to get the packages and then in scancode mode to get file level licenses. Can you try that method and see if you get back the package listings?

[nishakm]

So it was merged: #791. I'll have to dig into this more.

[amallayev]

Running in default mode is no problem with 2.2.0, the package listing works just fine. But with -x scancode I get different results between 2.1.0 and 2.2.0 when scanning Ubuntu 18.04 and Photon 3.0, see attached.

tern 2.2.0 with scancode:

photon-3.0-20200626.tern-scancode.13.10.2020.txt

ubuntu-20.04.tern-scancode.14.10.2020.txt

tern 2.1.0 with scancode:

photon-3.0-20200626.tern-scancode.28.08.2020.txt
ubuntu-20.04.tern-scancode.28.08.2020.txt

[nishakm]

@amallayev The problem seems to be the way tern runs scancode: scancode -ilpcu --quiet --timeout 300 --json - /path/to/rootfs. This doesn't report any package manifest data. Any idea how to fix this?

[amallayev]

@nishakm I wonder what changed in the way tern calls scancode, as such problem wasn't present in tern 2.1.0. Was tern 2.1.0 passing own package listing results besides scancode? I am using the release version of scancode, v3.1.1 and I indeed do not see package manifest data collected from rootfs.

[nishakm]

@nishakm I wonder what changed in the way tern calls scancode, as such problem wasn't present in tern 2.1.0. Was tern 2.1.0 passing own package listing results besides scancode?

Tern can consolidate results, yes. If you run tern report -i image:tag and then tern report -x scancode image:tag you will get a package inventory and file licenses.

I am using the release version of scancode, v3.1.1 and I indeed do not see package manifest data collected from rootfs.

I've asked the question to the scancode community. Let's see what happens.

[rnjudge]

@nishakm any update from the scancode community? This is something we may want to fix in 3.0.0.

[nishakm]

@nishakm any update from the scancode community? This is something we may want to fix in 3.0.0.

Nope. I recall you filed an issue?

[rnjudge]

@nishakm any update from the scancode community? This is something we may want to fix in 3.0.0.

Nope. I recall you filed an issue?

Not me. I thought "I've asked a question to the scancode community. Let's see what happens" meant that you filed an issue :) If there's no issue yet, I can open one.

[nishakm]

@nishakm any update from the scancode community? This is something we may want to fix in 3.0.0.

Nope. I recall you filed an issue?

Not me. I thought "I've asked a question to the scancode community. Let's see what happens" meant that you filed an issue :) If there's no issue yet, I can open one.

Sorry about that! I dropped the ball. I can file an issue.

[nishakm]

@nishakm any update from the scancode community? This is something we may want to fix in 3.0.0.

Nope. I recall you filed an issue?

Not me. I thought "I've asked a question to the scancode community. Let's see what happens" meant that you filed an issue :) If there's no issue yet, I can open one.

Sorry about that! I dropped the ball. I can file an issue.

Or if you get to it before I do, just put a link here

[rnjudge]

This issue should be fixed. Closing but please feel free to re-open if you notice this issue again.