Identified NOASSERTION not contained in the result from the backed

[fviernau]

Problem

1. When a file contains a single finding with NOASSERTION as the license.
2. And the snipped is identified by a matching include rule
3. Then the result contains an entry for the file with licenses = []
4. Problem: The NOASSERTION disappears from the result but may be relevant

Proposal

• Include also NOASSERTION in the result.

Question

As a work around or alternative, would it be valid to interpret licenses = [] as NOASSERTION ?

[isasmendiagus]

Thanks for the report — trying to reproduce on our side and need a bit more context:

• What are you scanning — a source file or a .wfp fingerprint? If you can share the file (or the WFP) that triggers it, that'd help a lot.
• The scanoss.json settings you're using (the relevant include rule).
• The resulting result.json entry for that file.

For context on what we're seeing so far: when a snippet matches a component that has no license in the KB, the server returns licenses: [] — we haven't observed it ever return the literal string NOASSERTION. So we want to confirm whether your case is (a) the server returning [] for a no-license component, or (b) a specific component whose declared license is actually NOASSERTION and it's getting dropped. Your file/purl would tell us which.

[tatysanic-maker22]

Hi @fviernau ,

This is just a friendly reminder that we're still waiting on your response to proceed with helping you :)

Best,
Tatiana
Head of Customer support
SCANOSS

[fviernau]

thanks @tatysanic-maker22! I'm now on it - investigating. Will reply once done.

[fviernau]

@isasmendiagus I've debugged this further and figured out that NOASSERTION in our code indeed never comes from SCANOSS backend, but is being used in case the backend returns license = [], see [1].
So, this issue is kind of invalid and can indeed be closed, thanks anyway for your help!

If you have a hint for me in which cases license = [] can actually happen, that would be interresting. E.g. can this only happen for
components, which do not have any license in their code repository at all? or in the respective file path?

e.g. in general, is there documentation on how the license information is actually determined?

[1] https://github.com/oss-review-toolkit/ort/blob/ce9007fbaae3ccd090aa13ef5690460fbbe8dd82/plugins/scanners/scanoss/src/main/kotlin/ScanOssResultParser.kt#L144-L146