Skip to content

Query and show detected licenses#4815

Merged
Etsija merged 6 commits intomainfrom
detected-licenses
Apr 15, 2026
Merged

Query and show detected licenses#4815
Etsija merged 6 commits intomainfrom
detected-licenses

Conversation

@Etsija
Copy link
Copy Markdown
Contributor

@Etsija Etsija commented Apr 10, 2026 •
edited
Loading

This PR adds a view for all license detections from the Scanner to the ORT run details. It is implemented as three endpoints and correspondingly, the UI consists of three tables within each other:

1. Top-level view: all detected licenses with the corresponding package counts

Screenshot from 2026-04-13 12-01-18

2. All projects/packages that have a detected license

Screenshot from 2026-04-13 12-01-53

3. License detection data for a license and project/package

Screenshot from 2026-04-13 12-02-31

NOTE: This is the first, sub-optimal implementation of the feature. It is recognized that the database queries are far from optimal, and even for a relatively small project, the top-level query takes between 1-2 seconds. There are several points for optimization, most notably:

  • possibly decomposing the SPDX license expressions into their respective atomic license components, which will change the views considerably
  • package curations are not taken into account at this stage. This can lead to false data shown, and needs to be corrected
  • the queries for fetching even relatively simple data are very long join chains on our normalized database. Most notable performance gains would probably be available with the following:
  1. (easy) Add index on scanner_jobs.ort_run_id.
  2. (schema change) Add a direct FK from scan_results to package_provenances. The queries need a cross-product between scan_results and package_provenances via scanner_runs, filtered by the provenanceCondition() multi-column string comparison (matching URL/hash fields across two tables). There's no direct FK between the two — they're linked by matching denormalized text fields. Adding a package_provenance_id FK column to scan_results would replace this expensive string-comparison filter with an indexed join.

@Etsija Etsija changed the title ui: Show detected licenses Query and show detected licenses Apr 10, 2026
@Etsija Etsija force-pushed the detected-licenses branch from e3b5257 to 5eca1e1 Compare April 10, 2026 09:49
@Etsija Etsija linked an issue Apr 10, 2026 that may be closed by this pull request
Need an endpoint to get license findings #2074
Closed
@eclipse-apoapsis eclipse-apoapsis deleted a comment from github-actions bot Apr 10, 2026
@sschuberth
Copy link
Copy Markdown
Contributor

sschuberth commented Apr 10, 2026

One thing that crossed my mind while evaluating https://github.com/mstykow/provenant is: Where / how should we display (potentially different) results from different scanners that were all configured to be run?

I'm not saying that we should address that question in this PR already, but it would be important to me that we don't go in a wrong direction here, which then makes adding this kind of information later on unnecessary hard.

Probably again something we should try to discuss briefly in a meeting to start with.

@Etsija
Copy link
Copy Markdown
Contributor Author

Etsija commented Apr 11, 2026

If it is possible to run several scanners in an ORT run, then I would think the relation would (or should, if it isn't already) be retained in scanner_runs.ort_run_id. That could maybe already provide a starting point for implementation.

sschuberth
sschuberth previously requested changes Apr 13, 2026
View reviewed changes
Comment thread ...ries/$repoId/runs/$runIndex/license-findings/-components/detected-license-findings-table.tsx Outdated
Comment thread ...d/repositories/$repoId/runs/$runIndex/license-findings/-components/license-findings-view.tsx Outdated
Comment thread ...outes/organizations/$orgId/products/$productId/repositories/$repoId/runs/$runIndex/route.tsx Outdated
Comment thread ...d/repositories/$repoId/runs/$runIndex/license-findings/-components/license-findings-view.tsx Outdated
Comment thread ...ries/$repoId/runs/$runIndex/license-findings/-components/detected-license-findings-table.tsx
Comment thread ...ries/$repoId/runs/$runIndex/license-findings/-components/detected-license-findings-table.tsx Outdated
Comment thread ...ries/$repoId/runs/$runIndex/license-findings/-components/detected-license-packages-table.tsx Outdated
Comment thread ...d/repositories/$repoId/runs/$runIndex/license-findings/-components/license-findings-view.tsx Outdated
@Etsija Etsija force-pushed the detected-licenses branch 2 times, most recently from 549350d to 61bfdc7 Compare April 13, 2026 09:00
@Etsija Etsija requested a review from sschuberth April 13, 2026 09:06
@sschuberth sschuberth dismissed their stale review April 13, 2026 09:27

LGTM UI-wise, thanks! Will leave the code review to @lamppu and @mnonnenmacher.

mnonnenmacher
mnonnenmacher requested changes Apr 13, 2026
View reviewed changes
Comment thread components/license-findings/backend/src/main/kotlin/LicenseFindingService.kt Outdated
Comment thread components/license-findings/backend/src/main/kotlin/LicenseFindingService.kt Outdated
Comment thread components/license-findings/backend/src/main/kotlin/LicenseFindingService.kt Outdated
Comment thread components/license-findings/backend/src/main/kotlin/LicenseFindingService.kt Outdated
Comment thread components/license-findings/backend/src/main/kotlin/LicenseFindingService.kt Outdated
Comment thread core/src/main/kotlin/di/Module.kt
Comment thread core/build.gradle.kts
Comment thread components/license-findings/backend/src/routes/kotlin/routes/GetRunDetectedLicenseFindings.kt Outdated
Comment thread components/license-findings/backend/src/routes/kotlin/routes/GetRunDetectedLicenses.kt Outdated
Comment thread core/src/main/kotlin/api/RunsRoute.kt Outdated
@Etsija Etsija force-pushed the detected-licenses branch from 61bfdc7 to c8ffde7 Compare April 14, 2026 07:07
@Etsija Etsija requested a review from mnonnenmacher April 14, 2026 07:07
@Etsija Etsija enabled auto-merge April 14, 2026 07:23
@Etsija Etsija force-pushed the detected-licenses branch from a020e0a to c8ffde7 Compare April 14, 2026 07:40
mnonnenmacher
mnonnenmacher requested changes Apr 15, 2026
View reviewed changes
Comment thread components/license-findings/api-model/src/commonMain/kotlin/DetectedLicensePackage.kt Outdated
Comment thread components/license-findings/api-model/src/commonMain/kotlin/LicenseFindingDetail.kt Outdated
Comment thread components/license-findings/api-model/src/commonMain/kotlin/DetectedLicensePackage.kt Outdated
Comment thread components/search/backend/src/test/kotlin/routes/GetRunsWithPackageIntegrationTest.kt Outdated
Comment thread model/src/commonMain/kotlin/runs/Identifier.kt Outdated
Comment thread components/license-findings/backend/src/main/kotlin/LicenseFindingService.kt Outdated
Comment thread components/license-findings/backend/src/routes/kotlin/Validation.kt Outdated
Comment thread ...nts/license-findings/backend/src/test/kotlin/routes/GetRunDetectedLicensesIntegrationTest.kt Outdated
Comment thread core/src/main/kotlin/plugins/Routing.kt Outdated
@Etsija Etsija force-pushed the detected-licenses branch from c8ffde7 to c3c01c4 Compare April 15, 2026 06:45
Etsija added 4 commits April 15, 2026 12:40
@Etsija
feat(license-findings): Add component API model
4896127 
Add classes for detected licenses, projects/packages with a detected 
license, and license detection data.

Signed-off-by: Jyrki Keisala <jyrki.keisala@doubleopen.org>
@Etsija
refactor(dao): Make toSortOrder() in DAO public for reuse
9adecc7 
Signed-off-by: Jyrki Keisala <jyrki.keisala@doubleopen.org>
@Etsija
refactor: Move toCoordinates() to Identifier class for reuse
6bbd9dd 
Also update its call sites in search component.

Signed-off-by: Jyrki Keisala <jyrki.keisala@doubleopen.org>
@Etsija
feat(license-findings): Add a service for querying license findings
55b1817 
Implement three functions: 
- one for finding all distinct detected licenses (as SPDX expressions for
  now), along with the count of projects/packages the license was found
  from
- one for listing all projects/packages that have a detected license
- one for all license detections in a project/package

Signed-off-by: Jyrki Keisala <jyrki.keisala@doubleopen.org>
Etsija added 2 commits April 15, 2026 12:41
@Etsija
feat(license-findings): Add API routes for license findings
4a8b968 
Signed-off-by: Jyrki Keisala <jyrki.keisala@doubleopen.org>
@Etsija
feat(ui): Add UI to show the license detection data
4dd045b 
Implement the UI as three-level table: 
- top table just lists all detected licenses with package counts
- its subrow is another paginated table with all projects/packages from
  where the license was found
- its subrow is the third paginated table which holds the license detection
  data for the license and project/package

Refactor each table view into its own local component, for easier review
and maintaining of the three-level table view.

Resolves #2074.

Signed-off-by: Jyrki Keisala <jyrki.keisala@doubleopen.org>
@Etsija Etsija force-pushed the detected-licenses branch from c3c01c4 to 4dd045b Compare April 15, 2026 09:44
@Etsija Etsija requested a review from mnonnenmacher April 15, 2026 09:47
@Etsija Etsija added this pull request to the merge queue Apr 15, 2026
Merged via the queue into main with commit 2011d9c Apr 15, 2026
34 checks passed
@Etsija Etsija deleted the detected-licenses branch April 15, 2026 10:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mnonnenmacher mnonnenmacher mnonnenmacher approved these changes

@lamppu lamppu Awaiting requested review from lamppu lamppu is a code owner

@bs-ondem bs-ondem Awaiting requested review from bs-ondem bs-ondem is a code owner

@MarcelBochtler MarcelBochtler Awaiting requested review from MarcelBochtler MarcelBochtler is a code owner

@nnobelis nnobelis Awaiting requested review from nnobelis nnobelis is a code owner

@oheger-bosch oheger-bosch Awaiting requested review from oheger-bosch oheger-bosch is a code owner

@wkl3nk wkl3nk Awaiting requested review from wkl3nk wkl3nk is a code owner

@sschuberth sschuberth Awaiting requested review from sschuberth sschuberth is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Need an endpoint to get license findings

3 participants

@Etsija @sschuberth @mnonnenmacher