Open tsteenbe opened 4 years ago
Is this still a thing, @tsteenbe?
Will retest this week as I am working and curations PRs atm
I recently have observed a similar behavior when scanning the Maven:org.apache.pdfbox:pdfbox:2.0.20
package with the following curation in place
- id: "Maven:org.apache.pdfbox:pdfbox:(,2.0.29]"
curations:
comment: "Wrong SVN repository path in parent POM: https://repo1.maven.org/maven2/org/apache/pdfbox/pdfbox-parent/2.0.29/pdfbox-parent-2.0.29.pom"
vcs:
type: "Subversion"
url: "https://svn.apache.org/repos/asf/pdfbox"
path: "pdfbox"
This results in the whole Subversion repository to be scanned, including all branches and tags.
Apache Hadoop depends on
Maven:org.apache.directory.api:api-asn1-api:1.0.0-M20
. Thisapi-asn1-api
packages is actually located in a sub directory of the parent repository so I created below curationWhilst testing above curation I noticed that ORT switches from analyzing the SVN repository to sources.jar so I presume this curation does not work so ORT switches. Is this a bug or am I doing something wrong?
Package details via ORT analyzer (#475ba0c8)