Kotlin Developer Meeting

This page hosts the agenda of Kotlin / deeply technical topics to be discussed by the core developers in a smaller round than the Community Meeting. If you want to contribute and have concrete technical questions, please ping us on Slack to get invited to the meeting.

Meeting Minutes

Future

Separate applying curations from analysis / apply curations for all package managers after all analyses finished
Avoid the need to individually filter out blank licenses or blank authors by implementing this as post-processing for all package managers.
Code style: Discuss nesting function inside functions. I hope we may end-up with a rule when it's ok / not ok to do.
Align on an approach of where plugin options should be parsed, see: https://github.com/oss-review-toolkit/ort/pull/7673#discussion_r1354273339
Should we support different configurations for the same scanner or different matchers for different storages? (https://github.com/oss-review-toolkit/ort/pull/7673#discussion_r1354338264)
Decide which content should stay in the README as most of it is currently duplicated in the docs.

2024-11-12

Where to add the "Project" suffix in https://github.com/oss-review-toolkit/ort/pull/9392?
Data model for https://github.com/oss-review-toolkit/ort/issues/9409.

2024-11-05

Proceed with https://github.com/oss-review-toolkit/ort/pull/9301.
Project vs package duplicates, which one to remove / keep?

2024-10-15

Used for backlog grooming ("Closed as part of backlog grooming. Feel free to comment if you would like to contribute to this.")
- Sorted issues from oldest to newest, stopped at page 6, https://github.com/oss-review-toolkit/ort/issues/7238.

2024-10-08

Setting SPDX's licenseDeclared e.g. for Go dependencies that have no metadata?
- Yes, based on RootLicenseMatcher.
- Additionally, the analyzer could query the GitHub API for "repository declared licenses" (which are actually licenses detected by Licensee).
Should we have a "too many scan failures" heuristic for scanners? Also see this discussion.
- Rather throw special exception from scanner implementation that generic heuristic on "client" side.
Used for backlog grooming ("Closed as part of backlog grooming. Feel free to comment if you would like to contribute to this.")
- Sorted issues from oldest to newest, stopped at page 6, https://github.com/oss-review-toolkit/ort/issues/6960.

2024-09-24

Build ORT with Java 21
- Postpone by at least one week to not cause migration efforts for this week's release, which contains important Bazel changes.
Remove SPDX document file analyzer in favor of making the package list helper-cli an analyzer.
- No, still required by Bosch. Better do another implementation based on the new SPDX Java library, similar to a new SPDX reporter.
- Also will be required by BitBake support.
Cleanup of teams.
- Proposal: Consolidate "Committers", "Contributes" and "core-devs" to just "devs".

2024-09-17

Discuss how to best represent projects which are part of a "workspace" in the analyzer result. As Project or as Package. See also node managers.

2024-09-10

New API to download JDKs.
- Expose version (and name) property to select JDK.
Remove NexusIQ.
- 90 day deprecation notice first, ask in community meeting.
Work to maintain CVSS vectors.
- Split severity into score and vector.

2024-08-27

Update on new plugin API: https://github.com/oss-review-toolkit/ort/pull/9002
Used for backlog grooming ("Closed as part of backlog grooming. Feel free to comment if you would like to contribute to this.")
- Sorted issues from oldest to newest, stopped at page 5, https://github.com/oss-review-toolkit/ort/issues/6668.

2024-08-20

Propagation of MDC context: https://github.com/oss-review-toolkit/ort/pull/9006
New plugin API: https://github.com/oss-review-toolkit/ort/pull/9002

2024-07-15

Better documents requirements / conventions for comment fields in ort-config curations.
- Maybe introduce a reason enum (similar to *ResolutionReason, with a default value of OTHER or UNSPECIFIED) and an optional related_urls array for more structure.
Agreed to drop support for old ScanCode versions.
Used for backlog grooming ("Closed as part of backlog grooming. Feel free to comment if you would like to contribute to this.")
- Sorted issues from oldest to newest, stopped at page 5, https://github.com/oss-review-toolkit/ort/issues/6186.

2024-07-08 (skipped)

Skipped due to general unavailability of participants.

2024-07-01

Used for backlog grooming ("Closed as part of backlog grooming. Feel free to comment if you would like to contribute to this.")
- Sorted issues from oldest to newest, stopped at page 4, https://github.com/oss-review-toolkit/ort/issues/5520.

2024-06-24

Used for backlog grooming ("Closed as part of backlog grooming. Feel free to comment if you would like to contribute to this.")
- Sorted issues from oldest to newest, stopped at page 4, https://github.com/oss-review-toolkit/ort/issues/5081.

2024-05-27

Used for backlog grooming ("Closed as part of backlog grooming. Feel free to comment if you would like to contribute to this.")
- Sorted issues from oldest to newest, stopped at https://github.com/oss-review-toolkit/ort/issues/3904.

2024-04-29

Used for backlog grooming ("Closed as part of backlog grooming. Feel free to comment if you would like to contribute to this.")
- Sorted issues from oldest to newest, stopped at https://github.com/oss-review-toolkit/ort/issues/3085.

2024-04-08

Heads up: More Cargo refactoring PRs upcoming to solve https://github.com/oss-review-toolkit/ort/issues/8480.
Martin has ticket in sprint to continue working on solving Docker "race-condition" issues.

2024-01-29

Proceed with https://github.com/oss-review-toolkit/ort/pull/8152.
Do we finally want to officially support analyzing projects that are not under version control?

2024-01-08

Scanner API improvements
- Teach scanPackage about the configured sourceCodeOrigins.
- Make the global scanner configuration accessible from scanner implementations.
Remove the SpdxExpression.licenses() function as it makes it too easy to do "dangerous" things?
Replace the ort-config's curation project with a script-based solution?
Allow key / value pair as license categories with arbitrary values, see this.

2023-12-18

Discuss guidelines for ort-config contributions
- https://github.com/oss-review-toolkit/ort-config/pull/154
- https://github.com/oss-review-toolkit/ort-config/pull/156
Discuss https://github.com/oss-review-toolkit/ort/issues/7921, in particular
- https://github.com/oss-review-toolkit/ort/pull/8026
- https://github.com/oss-review-toolkit/ort/pull/8039

2023-11-27

Discuss how we could approach: https://github.com/oss-review-toolkit/ort/issues/7921

2023-11-20

Merge https://github.com/oss-review-toolkit/ort/pull/7853 despite theoretical Docker image issues?
Don't let https://github.com/oss-review-toolkit/ort/pull/7888 linger around for too long.
Continue https://github.com/oss-review-toolkit/ort/pull/7697.
Let scanner wrapper implementations know what packages their have scanned in case of "monorepos".

2023-10-30

Where to apply default values for advisor configuration?
Align create(options: Options) implementations.
Get rid of double config nesting in ORT results for advisor / scanner configuration?
- We should try to avoid constructs like val frontendUrl = ortResult.scanner?.config?.config?.get("DOS")?.options?.get("frontendUrl"), maybe by introducing a helper extension function (as a smooth transition to an interface-based API).

2023-10-09

Consider replacing SourceCodeOrigin with List<KnownProvenance>.
- No, probably better to separate configuration names from class hierarchies.
Discussion about Package manager implementations to expose the types of packages they create as part of the API.

2023-09-18

Maintain orthw and helper-cli in a single repo?

2023-09-04

Discuss supplier / organization information.
How to proceed with VCS location duplicates?
How to proceed with NuGet namespace generation?

2023-08-30

What should be the first SemVer of ORT (1.0.0 vs. 0.0.1)? Any particular commit to tag?
- Go for "1.0.0", tag a recent commit, like the last one from the "release notes" in the last Community Meeting
How to proceed with unit test failure in https://github.com/oss-review-toolkit/ort/pull/7397 due to conditional ScanCode CLI options?
Discuss command to create a "flat" analyzer result: https://github.com/oss-review-toolkit/ort/pull/7305

2023-08-21

Heads up for https://github.com/oss-review-toolkit/ort/pull/7331; basically no objections, but send notice to HERE who might be affected via license curations.

2023-07-24

Can https://github.com/oss-review-toolkit/ort/issues/5681 be closed?

2023-07-17

Review PRs that migrate scanner results parsers to kotlinx-serialization
Consolidate the FileStorage and ProvenanceFileStorage interfaces (null vs exception semantics)
- Probably becomes void with https://github.com/oss-review-toolkit/ort/pull/7292
Implementing snippet choice

2023-07-10

New detected licenses appears for SPDX project with submodule
- See https://github.com/oss-review-toolkit/ort/issues/7231#issuecomment-1629577276 for a summary of the issue and the proposed solution.

2023-07-03

Use https://github.com/kopykat-kt/kopykat? -> No general objections.

2023-06-26

Where to put extension functions? https://github.com/oss-review-toolkit/ort/pull/7180#discussion_r1238376009
- No obvious single rule, continue to decide case by case.
- Maybe try to group extension function by purpose, like already done in GradleModelExtensions.kt.
- Probably avoid putting arbitrary extension functions into a single file, but rather put code into an existing Utils.kt.
Should we explicitly return empty vulnerabilities? https://github.com/oss-review-toolkit/ort/pull/7196#discussion_r1241260223

2023-06-19

2023-06-12

Try to switch to the legacy Docker again in order to work around the current disk space issues in the functional tests.
Ideas for an Amazon S3-based (scan) storage implementation
- Probably requires code clean-ups first
  - Configure storages only once
  - https://github.com/oss-review-toolkit/ort/issues/6603

2023-06-05

CI fails due to insufficient disk space for Docker runs
Review of
- https://github.com/oss-review-toolkit/ort/pull/7068 -> @sschuberth
- https://github.com/oss-review-toolkit/ort/pull/7078 -> @mnonnenmacher

2023-05-22

Style: fromUrl() vs forUrl() -> Makes sense to have the differentiation
Serialize resolved curation providers with empty curations? https://github.com/oss-review-toolkit/ort/blob/c14dee77330585cbcc41ce62a43d9e3a85ada07c/model/src/main/kotlin/ResolvedConfiguration.kt#L84 -> Keep them for explicitness

2023-04-17

Snippet scanner model changes (https://github.com/oss-review-toolkit/ort/pull/6791)

2023-03-20

ORT Result API / abstraction
- Dependency Tree vs. Graph (https://github.com/oss-review-toolkit/ort/issues/3825)

2023-03-06

New GoMod issue to look at.
How to move forward with (configurable advisor plugins)[https://github.com/oss-review-toolkit/ort/pull/6613]?

2023-02-26

Maven caching needs fixing
- Consider changes to init.gradle
- Do not cache remote artifacts for unknown extensions
Allow project / package "duplicates" with the same VCS location

2023-02-20

Allow to limit scan storage providers to packages (not projects)
- Make scan storage providers take an "entitity" enum similar to like the ScannerCommand used to
How to proceed with failing CI in https://github.com/oss-review-toolkit/ort/pull/6489?
- Maven artifact caching issues were found and fixed

2023-02-06

Give curation providers access to more metadata than just the package's Identifier: https://github.com/oss-review-toolkit/ort/pull/6387
Agree on how to fix https://github.com/oss-review-toolkit/ort/issues/3289.

2023-01-16

Separating & Re-applying curations for specific providers (see this comment)
Automated releases

2023-01-09

Enable conventional commits (via https://github.com/conventional-changelog/commitlint)
Discuss curation provider configuration (https://github.com/oss-review-toolkit/ort/pull/6308)

2022-12-19

Stop using a SortedSet in ProjectAnalyzerResult (https://github.com/oss-review-toolkit/ort/pull/6244)

2022-11-28

Release strategy
- Decide for a module that can be moved to an independent repository for testing release automation.
  - Let's use https://github.com/oss-review-toolkit/ort/tree/main/clients/scanoss
  - Use dependency substitution to substitute an external module dependency with a project dependency
- Try out https://github.com/renovatebot/renovate

2022-11-21

Should we do extract conventional namespaces for NuGet?
- Tendency yes, but probably use al but last component for namespace.

2022-11-14

Discuss how dependency injection with Koin looks like
- Should we share all of OrtConfiguration or only / also tool-specific config classes?

2022-11-07

Ok to merge https://github.com/oss-review-toolkit/ort/pull/6030?
- Yes
Poll about handling Copyright statements without owner as unprocessed.
- Clarify how Copyright statements without owners should legally be handled.
Warn if no provenanceStorage is configured?
- Maybe also warn / hint about local storages in general?
More reviews from Bosch side needed.
- Noted.

 ______________________________
/        \_______   \__    ___/ The OSS Review Toolkit, version 1.0.0.
|    |   | |       _/ |    |
|    |   | |    |   \ |    |    Running 'wiki' as 'ort' under Java on GitHub
\________/ |____|___/ |____|    with a lot of CPUs and a maximum amount of memory.