ort scanner error: IOException: Could not resolve provenance for package 'NPM:@adam-family:am-common-lib:18.3.0' for source code origins [VCS, ARTIFACT]."

[AudiAlex]

Hi all,
I run the ort analyzer on a npm project, where a dependency(package) is located within an private repo package.
with my .npmrc config the analyzer works without any issues.
But what I can see in the analyzer-result file at the section for these dependency at part of VCS an VCS_PROCESSED - is empty.

I think this is why the ort scanner produces the error
IOException: Could not resolve provenance for package 'NPM:@adam-family:am-common-lib:18.3.0'
\ for source code origins [VCS, ARTIFACT]."

Can anyone help me regading this issue or how to work with private repo packages and to scan these ones?

thx
alex

[sschuberth]

But what I can see in the analyzer-result file at the section for these dependency at part of VCS an VCS_PROCESSED - is empty.

This is not necessarily a problem. If no repository was defined in your private package.json, then these fields will be empty. ORT then tries to get the source code from an NPM .tgz artifact instead.

IOException: Could not resolve provenance for package 'NPM:https://github.com/adam-family:am-common-lib:18.3.0' for source code origins [VCS, ARTIFACT]."

This means that ORT found neither a VCS repository nor an artifact that provides the source code. While you have your credentials in .npmrc, the scanner does not use NPM to download the artifacts, which means that it fails to discover the artifact unless you also provide your credentials in a .netrc file.

[AudiAlex]

hey, thx for the quick reply. I will have a closer look on that