New ort bom file format

analyzer/src/funTest/kotlin/PackageManagerFunTest.kt

@@ -73,7 +73,8 @@ class PackageManagerFunTest : WordSpec({
         "spdx-project/project.spdx.yml",
         "spm-app/Package.resolved",
         "spm-lib/Package.swift",
-        "stack/stack.yaml"
+        "stack/stack.yaml",
+        "ort-project/ort.project.yml"
     )
 
     val projectDir = tempdir()

gradle/libs.versions.toml

@@ -55,6 +55,7 @@ mordant = "3.0.2"
 okhttp = "5.3.2"
 postgres = "42.7.8"
 postgresEmbedded = "1.1.1"
+purlkt = "0.0.7"
 reflections = "0.10.2"
 retrofit = "3.0.0"
 s3 = "2.40.1"
@@ -167,6 +168,7 @@ okhttp = { module = "com.squareup.okhttp3:okhttp", version.ref = "okhttp" }
 okhttp-loggingInterceptor = { module = "com.squareup.okhttp3:logging-interceptor", version.ref = "okhttp" }
 postgres = { module = "org.postgresql:postgresql", version.ref = "postgres" }
 postgresEmbedded = { module = "com.opentable.components:otj-pg-embedded", version.ref = "postgresEmbedded" }
+purlkt = { module = "space.iseki.purlkt:purlkt", version.ref = "purlkt"}
 reflections = { module = "org.reflections:reflections", version.ref = "reflections" }
 retrofit = { module = "com.squareup.retrofit2:retrofit", version.ref = "retrofit" }
 retrofit-converter-jackson = { module = "com.squareup.retrofit2:converter-jackson", version.ref = "retrofit" }

integrations/schemas/package-managers-schema.json

@@ -18,6 +18,7 @@
         "Maven",
         "NPM",
         "NuGet",
+        "OrtProjectFile",
         "PIP",
         "Pipenv",
         "PNPM",

model/build.gradle.kts

@@ -41,6 +41,7 @@ dependencies {
     implementation(libs.bundles.hoplite)
     implementation(libs.hikari)
     implementation(libs.postgres)
+    implementation(libs.purlkt)
     implementation(libs.semver4j)
     implementation(libs.tika)
 

model/src/main/kotlin/Identifier.kt

@@ -25,6 +25,9 @@ import com.fasterxml.jackson.annotation.JsonValue
 import org.ossreviewtoolkit.utils.common.AlphaNumericComparator
 import org.ossreviewtoolkit.utils.common.encodeOr
 
+import space.iseki.purl.PUrl
+import space.iseki.purl.PUrlParsingException
+
 /**
  * A unique identifier for a software component.
  */
@@ -66,6 +69,16 @@ data class Identifier(
         // This comparator is consistent with `equals()` as all properties are taken into account.
         private val COMPARATOR = compareBy<Identifier>({ it.type }, { it.namespace }, { it.name })
             .thenComparing({ it.version }, AlphaNumericComparator)
+
+        @Suppress("SwallowedException")
+        fun fromPurl(purlString: String): Identifier {
+            try {
+                val purl = PUrl.parse(purlString)
+                return Identifier(purl.type, purl.namespace.joinToString("."), purl.name, purl.version)
+            } catch (ex: PUrlParsingException) {
+                throw IllegalArgumentException(ex.message)
+            }
+        }
     }
 
     private constructor(properties: List<String>) : this(

model/src/main/kotlin/config/AnalyzerConfiguration.kt

@@ -60,6 +60,7 @@ data class AnalyzerConfiguration(
         "Maven",
         "NPM",
         "NuGet",
+        "OrtProjectFile",
         "PIP",
         "Pipenv",
         "PNPM",

model/src/test/kotlin/IdentifierTest.kt

@@ -20,6 +20,7 @@
 package org.ossreviewtoolkit.model
 
 import io.kotest.assertions.assertSoftly
+import io.kotest.assertions.throwables.shouldThrow
 import io.kotest.core.spec.style.WordSpec
 import io.kotest.inspectors.forAll
 import io.kotest.matchers.maps.containExactly
@@ -135,4 +136,34 @@ class IdentifierTest : WordSpec({
             }
         }
     }
+
+    "Purl representation" should {
+        "should accept only pkg type purls" {
+            shouldThrow<IllegalArgumentException> {
+                Identifier.fromPurl("nonpkg:someurl/example.com/invalid@1.1")
+            }
+        }
+
+        "be parsed correctly for purl with namespace" {
+            val id = Identifier.fromPurl("pkg:github/example.com/valid-with-namespace@1.0")
+
+            with(id) {
+                type shouldBe "github"
+                namespace shouldBe "example.com"
+                name shouldBe "valid-with-namespace"
+                version shouldBe "1.0"
+            }
+        }
+
+        "be parsed correctly for purl without namespace" {
+            val id = Identifier.fromPurl("pkg:pypi/valid-without-namespace@2.0")
+
+            with(id) {
+                type shouldBe "pypi"
+                namespace shouldBe ""
+                name shouldBe "valid-without-namespace"
+                version shouldBe "2.0"
+            }
+        }
+    }
 })

plugins/package-managers/ortproject/build.gradle.kts

@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2025 The ORT Project Copyright Holders <https://github.com/oss-review-toolkit/ort/blob/main/NOTICE>
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ * License-Filename: LICENSE
+ */
+
+plugins {
+    // Apply precompiled plugins.
+    id("ort-plugin-conventions")
+
+    // Apply third-party plugins.
+    alias(libs.plugins.kotlinSerialization)
+}
+
+dependencies {
+    api(projects.analyzer)
+    api(projects.model)
+
+    implementation(projects.utils.ortUtils)
+
+    implementation(jacksonLibs.jacksonModuleKotlin)
+    implementation(libs.kotlinx.serialization.core)
+    implementation(libs.kotlinx.serialization.yaml)
+
+    ksp(projects.analyzer)
+
+    funTestImplementation(testFixtures(projects.analyzer))
+}

plugins/package-managers/ortproject/src/funTest/assets/multiproject/ort.project.yml

@@ -0,0 +1,35 @@
+projectName: "Example ORT project"
+description: "Project X description"
+homepageUrl: "https://project_x.example.com"
+declaredLicenses:
+  - "Apache-2.0"
+authors:
+  - "John Doe"
+  - "Foo Bar"
+dependencies:
+  - purl: "pkg:maven/com.example/full@1.1.0"
+    description: "Package with fully elaborated model."
+    vcs:
+      type: "Mercurial"
+      url: "https://git.example.com/full/"
+      revision: "master"
+      path: "/"
+    sourceArtifact:
+      url: "https://repo.example.com/m2/full-1.1.0-sources.jar"
+      hash: "da39a3ee5e6b4b0d3255bfef95601890afd80709"
+    declaredLicenses:
+      - "Apache-2.0"
+      - "MIT"
+    homepageUrl: "https://project_x.example.com/full"
+    labels:
+      label: "value"
+      label2: "value2"
+    authors:
+      - "John Doe"
+      - "Foo Bar"
+    scopes:
+      - "main"
+    isModified: false
+    metadataOnly: false
+
+  - purl: "pkg:maven/com.example/minimal@0.1.0"

plugins/package-managers/ortproject/src/funTest/assets/multiproject/subproject1/sub1.ort.project.yml

@@ -0,0 +1,35 @@
+projectName: "Example ORT project"
+description: "Project X description"
+homepageUrl: "https://project_x.example.com"
+declaredLicenses:
+  - "Apache-2.0"
+authors:
+  - "John Doe"
+  - "Foo Bar"
+dependencies:
+  - purl: "pkg:maven/com.example/full@1.1.0"
+    description: "Package with fully elaborated model."
+    vcs:
+      type: "Mercurial"
+      url: "https://git.example.com/full/"
+      revision: "master"
+      path: "/"
+    sourceArtifact:
+      url: "https://repo.example.com/m2/full-1.1.0-sources.jar"
+      hash: "da39a3ee5e6b4b0d3255bfef95601890afd80709"
+    declaredLicenses:
+      - "Apache-2.0"
+      - "MIT"
+    homepageUrl: "https://project_x.example.com/full"
+    labels:
+      label: "value"
+      label2: "value2"
+    authors:
+      - "John Doe"
+      - "Foo Bar"
+    scopes:
+      - "main"
+    isModified: false
+    metadataOnly: false
+
+  - purl: "pkg:maven/com.example/minimal@0.1.0"

plugins/package-managers/ortproject/src/funTest/assets/multiproject/subproject2/ort.project.json

@@ -0,0 +1,49 @@
+{
+  "projectName": "Example ORT project",
+  "description": "Project X description",
+  "homepageUrl": "https://project_x.example.com",
+  "declaredLicenses": [
+    "Apache-2.0"
+  ],
+  "authors": [
+    "John Doe",
+    "Foo Bar"
+  ],
+  "dependencies": [
+    {
+      "purl": "pkg:maven/com.example/full@1.1.0",
+      "description": "Package with fully elaborated model.",
+      "vcs": {
+        "type": "Mercurial",
+        "url": "https://git.example.com/full/",
+        "revision": "master",
+        "path": "/"
+      },
+      "sourceArtifact": {
+        "url": "https://repo.example.com/m2/full-1.1.0-sources.jar",
+        "hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709"
+      },
+      "declaredLicenses": [
+        "Apache-2.0",
+        "MIT"
+      ],
+      "homepageUrl": "https://project_x.example.com/full",
+      "labels": {
+        "label": "value",
+        "label2": "value2"
+      },
+      "authors": [
+        "John Doe",
+        "Foo Bar"
+      ],
+      "scopes": [
+        "main"
+      ],
+      "isModified": false,
+      "metadataOnly": false
+    },
+    {
+      "purl": "pkg:maven/com.example/minimal@0.1.0"
+    }
+  ]
+}

plugins/package-managers/ortproject/src/funTest/assets/projects/no-pkg-id-or-pur.ort.project.yml

@@ -0,0 +1,32 @@
+projectName: "Example ORT project"
+description: "Project X description"
+homepageUrl: "https://project_x.example.com"
+declaredLicenses:
+  - "Apache-2.0"
+authors:
+  - "John Doe"
+  - "Foo Bar"
+dependencies:
+  - description: "Package with fully elaborated model."
+    vcs:
+      type: "Mercurial"
+      url: "https://git.example.com/full/"
+      revision: "master"
+      path: "/"
+    sourceArtifact:
+      url: "https://repo.example.com/m2/full-1.1.0-sources.jar"
+      hash: "da39a3ee5e6b4b0d3255bfef95601890afd80709"
+    declaredLicenses:
+      - "Apache-2.0"
+      - "MIT"
+    homepageUrl: "https://project_x.example.com/full"
+    labels:
+      label: "value"
+      label2: "value2"
+    authors:
+      - "Doe John"
+      - "Bar Foo"
+    scopes:
+      - "main"
+    isModified: false
+    metadataOnly: false

plugins/package-managers/ortproject/src/funTest/assets/projects/ort.project.json

@@ -0,0 +1,49 @@
+{
+  "projectName": "Example ORT project",
+  "description": "Project X description",
+  "homepageUrl": "https://project_x.example.com",
+  "declaredLicenses": [
+    "Apache-2.0"
+  ],
+  "authors": [
+    "John Doe",
+    "Foo Bar"
+  ],
+  "dependencies": [
+    {
+      "purl": "pkg:maven/com.example/full@1.1.0",
+      "description": "Package with fully elaborated model.",
+      "vcs": {
+        "type": "Mercurial",
+        "url": "https://git.example.com/full/",
+        "revision": "master",
+        "path": "/"
+      },
+      "sourceArtifact": {
+        "url": "https://repo.example.com/m2/full-1.1.0-sources.jar",
+        "hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709"
+      },
+      "declaredLicenses": [
+        "Apache-2.0",
+        "MIT"
+      ],
+      "homepageUrl": "https://project_x.example.com/full",
+      "labels": {
+        "label": "value",
+        "label2": "value2"
+      },
+      "authors": [
+        "Doe John",
+        "Bar Foo"
+      ],
+      "scopes": [
+        "main"
+      ],
+      "isModified": false,
+      "metadataOnly": false
+    },
+    {
+      "purl": "pkg:maven/com.example/minimal@0.1.0"
+    }
+  ]
+}