Eclipse Apoapsis™ - ORT Server

GEBIT Modifications

The commits prefixed with DINF-1255: add GEBIT-specific extensions to the ORT Analyzer:

• GebitPackageCurationProvider applies the concluded license LicenseRef-GEBIT to Maven packages in the configured GEBIT namespaces and their descendants. The default namespaces are de.gebit.rp, de.gebit.pos, de.gebit.trend, de.gebit.compas, de.gebit.ep, de.gebit.integrity, de.gebit.wildfly, and de.gebit.lib. The provider also supports custom namespaces and exact package-coordinate curations with SPDX license expressions. These curations can be configured in ort-server.params.kts; see the deployment example.
• MavenNoTestDependencies, NpmNoDevDependencies, and PubNoDevDependencies wrap ORT's built-in package managers while always excluding Maven test, NPM devDependencies, and Pub dev_dependencies scopes, respectively. They retain the delegates' dependency-resolution behavior and expose the relevant built-in options.
• The Pub adapter additionally expands YAML anchors and aliases before delegation, and exposes the allowDynamicVersions option for lockfile-free or dynamic-version projects.

The custom plugins are packaged in shared modules and included in the Analyzer worker. build-analyzer-image.sh builds the base, Analyzer base, and final Analyzer worker images needed to run these extensions.

The Eclipse Apoapsis project's ORT Server is a standalone application to deploy the OSS Review Toolkit as a service in the cloud.

Note

This project is currently in the incubation phase at the Eclipse Foundation and working towards making the first release. Once released, the project will use semantic versioning, until then breaking changes can occur at any time.

Community

To communicate with the developers, you can:

• Join the Matrix chat.
• Start a GitHub discussion.
• Join the mailing list.

Please report any issues to the issue tracker.

Contributions are welcome, please see the contributing guide for more information.

Running ORT Server

The easiest way to run the ORT Server for testing is to use Docker Compose. For a proper deployment to Kubernetes, the project will later provide a Helm chart.

Docker Compose

Caution

Do not use the Docker Compose setup in production as it uses multiple insecure defaults, like providing Keycloak without TLS.

To start the ORT Server with the required third-party services run:

docker compose up

Once the services are up and running, you can access the ORT Server UI at http://localhost:8082.

See the documentation for detailed instructions, for example, to run Docker Compose with local images.

Publish Docker Images

To publish the Docker images to a registry, first build the worker base images as described in the documentation. Then you can use the jib task to publish the images by setting the correct prefix for the registry. You can also configure the tag which defaults to latest.

# Publish all Docker images.
./gradlew -PdockerImagePrefix=my.registry/ tinyJibPublish

# Publish one specific image.
./gradlew -PdockerImagePrefix=my.registry/ :core:tinyJibPublish

# Publish using a custom tag.
./gradlew -PdockerImagePrefix=my.registry/ -PdockerImageTag=custom tinyJibPublish

Generate OpenAPI specification

The OpenAPI specification can be generated by running this Gradle task:

./gradlew :core:generateOpenApiSpec

The task writes the specification to ui/build/openapi.json.

License

See the NOTICE file in the root of this project for the copyright details.

See the LICENSE file in the root of this project for license details.