reference.yml

# Copyright (C) 2022 The ORT Project Authors (see <https://github.com/oss-review-toolkit/ort/blob/main/NOTICE>)
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# SPDX-License-Identifier: Apache-2.0
# License-Filename: LICENSE

# A reference configuration file containing all possible ORT configuration options. Some of those options are mutually
# exclusive, so this file is only used to show all options and to validate the configuration.

ort:
  allowedProcessEnvironmentVariableNames:
    - PASSPORT
    - USER_HOME
  deniedProcessEnvironmentVariablesSubstrings:
    - PASS
    - SECRET
    - TOKEN
    - USER

  enableRepositoryPackageConfigurations: true
  enableRepositoryPackageCurations: true

  licenseFilePatterns:
    licenseFilenames: ['license*']
    patentFilenames: ['patents']
    rootLicenseFilenames: ['readme*']

  # Providers are listed from highest to lower priority. Technically, they are applied in reverse order: The provider
  # with the highest priority is applied last, so it can overwrite any previously applied curations.
  packageCurationProviders:
    - type: DefaultFile
    - type: DefaultDir
    - type: File
      id: SomeCurationsFile
      config:
        path: '/some-path/curations.yml'
        mustExist: true
    - type: File
      id: SomeCurationsDir
      config:
        path: '/some-path/curations-dir'
        mustExist: false
    - type: OrtConfig
      enabled: '${USE_ORT_CONFIG_CURATIONS:-true}'
    - type: ClearlyDefined
      config:
        serverUrl: 'https://api.clearlydefined.io'
        minTotalLicenseScore: 80
    - type: SW360
      config:
        restUrl: 'https://your-sw360-rest-url'
        authUrl: 'https://your-authentication-url'
        username: username
        password: password
        clientId: clientId
        clientPassword: clientPassword
        token: token

  severeIssueThreshold: ERROR
  severeRuleViolationThreshold: ERROR

  analyzer:
    allowDynamicVersions: true

    # A list of enabled package managers.
    enabledPackageManagers: [Gradle]

    # A list of disabled package managers. Disabling a package manager here overrides enabling it in
    # `enabledPackageManagers`.
    disabledPackageManagers: [Maven, NPM]

    # A flag to control whether excluded scopes and paths should be skipped during the analysis.
    skipExcluded: true

    packageManagers:
      Gradle:
        # A list of package manager names that this package manager must run after. For example, this can be used if
        # another package manager generates files that this package manager requires to run correctly.
        mustRunAfter: [NPM]

      Yarn2:
        options:
          # If set to true, disable verification of HTTPS certificate of remote registries. Useful when using a proxy to
          # intercept requests to the registry.
          disableRegistryCertificateVerification: false

      Conan:
        # Holds a name of the lockfile. Required if allowDynamicVersions = false.
        # The lockfile should be located in the same directory as the conanfile.py or conanfile.txt.
        options:
          lockfileName: "lockfile.lock"

  advisor:
    nexusIq:
      serverUrl: 'https://rest-api-url-of-your-nexus-iq-server'
      browseUrl: 'https://web-browsing-url-of-your-nexus-iq-server'
      username: username
      password: password

    ossIndex:
      username: username
      password: password

    vulnerableCode:
      serverUrl: 'http://localhost:8000'
      apiKey: 0123456789012345678901234567890123456789

    gitHubDefects:
      token: githubAccessToken
      labelFilter: ['!duplicate', '!enhancement', '!invalid', '!question', '!documentation', '*']
      maxNumberOfIssuesPerRepository: 50
      parallelRequests: 5

    osv:
      serverUrl: 'https://api.osv.dev'

    options:
      # A map of maps from advice provider names to provider-specific key-value pairs. This map can be used to provide
      # configuration information for external advisor plugins.
      CustomAdvisor:
        apiKey: '<some_api_key>'

  downloader:
    allowMovingRevisions: true

    # Only used if the '--license-classifications-file' option is specified.
    includedLicenseCategories:
      - 'category-a'
      - 'category-b'

    sourceCodeOrigins: [VCS, ARTIFACT]

  scanner:
    skipConcluded: true

    archive:
      enabled: true

      fileStorage:
        localFileStorage:
          directory: ~/.ort/scanner/archive
          compression: false

      postgresStorage:
        connection:
          url: 'jdbc:postgresql://your-postgresql-server:5444/your-database'
          schema: public
          username: username
          password: password
          sslmode: required
          sslcert: /defaultdir/postgresql.crt
          sslkey: /defaultdir/postgresql.pk8
          sslrootcert: /defaultdir/root.crt
          parallelTransactions: 5

    createMissingArchives: false

    # Map scanner license findings to valid SPDX licenses. Note that these mappings are only applied in new scans,
    # stored scan results are not affected.
    detectedLicenseMapping:
      BSD (Three Clause License): 'BSD-3-clause'
      LicenseRef-scancode-generic-cla: 'NOASSERTION'

    fileListStorage:
      fileStorage:
        localFileStorage:
          directory: ~/.ort/scanner/file-lists
          compression: false

      postgresStorage:
        connection:
          url: 'jdbc:postgresql://your-postgresql-server:5444/your-database'
          schema: public
          username: username
          password: password
          sslmode: required
          sslcert: /defaultdir/postgresql.crt
          sslkey: /defaultdir/postgresql.pk8
          sslrootcert: /defaultdir/root.crt
          parallelTransactions: 5

    options:
      # A map of maps from scanner class names to scanner-specific key-value pairs.
      ScanCode:
        # Command line options that affect the ScanCode output. If changed, stored scan results that were created with
        # different options are not reused.
        commandLine: '--copyright --license --info --strip-root --timeout 300'

        # Command line options that do not affect the ScanCode output.
        commandLineNonConfig: '--processes 4'

        parseLicenseExpressions: true

        # Criteria for matching stored scan results. These can be configured for any scanner that uses semantic
        # versioning. Note that the 'maxVersion' is exclusive and not part of the range of accepted versions.
        minVersion: '3.2.1-rc2'
        maxVersion: '32.0.0'

      FossId:
        serverUrl: 'https://fossid.example.com/instance/'
        user: user
        apiKey: XYZ

        namingProjectPattern: '$Var1_$Var2'
        namingScanPattern: '$Var1_#projectBaseCode_$Var3'
        namingVariableVar1: myOrg
        namingVariableVar2: myTeam
        namingVariableVar3: myUnit

        waitForResult: false

        keepFailedScans: false
        deltaScans: true
        deltaScanLimit: 10

        detectLicenseDeclarations: true
        detectCopyrightStatements: true

        timeout: 60

        urlMappingExample: "https://my-repo.example.org(?<repoPath>.*) -> ssh://my-mapped-repo.example.org${repoPath}"

    storages:
      local:
        backend:
          localFileStorage:
            directory: ~/.ort/scanner/results
            compression: false

      http:
        backend:
          httpFileStorage:
            url: 'https://your-http-server'
            query: '?username=user&password=123'
            headers:
              key1: value1
              key2: value2

      clearlyDefined:
        serverUrl: 'https://api.clearlydefined.io'

      postgres:
        connection:
          url: 'jdbc:postgresql://your-postgresql-server:5444/your-database'
          schema: public
          username: username
          password: password
          sslmode: required
          sslcert: /defaultdir/postgresql.crt
          sslkey: /defaultdir/postgresql.pk8
          sslrootcert: /defaultdir/root.crt
        type: PROVENANCE_BASED

      sw360Configuration:
        restUrl: 'https://your-sw360-rest-url'
        authUrl: 'https://your-authentication-url'
        username: username
        password: password
        clientId: clientId
        clientPassword: clientPassword
        token: token

    # Storage readers are listed from highest to lower priority, i.e. the first match wins.
    storageReaders: [local, postgres, http, clearlyDefined]

    # For storage writers no priority is implied by the order; scan results are stored for all writers.
    storageWriters: [postgres]

    ignorePatterns: ['**/META-INF/DEPENDENCIES']

    provenanceStorage:
      fileStorage:
        localFileStorage:
          directory: ~/.ort/scanner/provenance
          compression: false

      postgresStorage:
        connection:
          url: 'jdbc:postgresql://your-postgresql-server:5444/your-database'
          schema: public
          username: username
          password: password
          sslmode: required
          sslcert: /defaultdir/postgresql.crt
          sslkey: /defaultdir/postgresql.pk8
          sslrootcert: /defaultdir/root.crt

  reporter:
    options:
      FossId:
        serverUrl: 'https://fossid.example.com/instance/'
        user: user
        apiKey: XYZ

  notifier:
    mail:
      hostName: 'localhost'
      username: user
      password: password
      port: 465
      useSsl: true
      fromAddress: 'no-reply@oss-review-toolkit.org'

    jira:
        host: 'localhost'
        username: user
        password: password