fix(spdxdocumentfile): Get VcsInfo from downloadLocation by default

If downloadLocation is set to vcs sources, it should always be
in use first, as in many cases spdx files are being scanned
from dedicated repositories that don't contain sources of
declared components or project that is being scanned with
spdx manager.
Getting vcs source information from project dir will be
neccessary in specific cases, where some internally
developed dependencies are in use during scan.

Signed-off-by: Mateusz Los <extern.mateusz.los@cariad.technology>

Author: losmateusz1

plugins/package-managers/spdx-document-file/src/funTest/assets/projects/synthetic/spdx-project-cyclic-expected-output.yml

@@ -56,14 +56,14 @@ packages:
       algorithm: ""
   vcs:
     type: "Git"
-    url: "<REPLACE_VCS_URL>"
-    revision: "<REPLACE_VCS_REVISION>"
-    path: "plugins/package-managers/spdx-document-file/src/funTest/assets/projects/synthetic/cyclic-references"
+    url: "ssh://gitlab.example.com:3389/products/abc.git"
+    revision: "b2c358080011af6a366d2512a25a379fbe7b1f78"
+    path: ""
   vcs_processed:
     type: "Git"
-    url: "<REPLACE_VCS_PROCESSED_URL>"
-    revision: "<REPLACE_VCS_REVISION>"
-    path: "plugins/package-managers/spdx-document-file/src/funTest/assets/projects/synthetic/cyclic-references"
+    url: "ssh://gitlab.example.com:3389/products/abc.git"
+    revision: "b2c358080011af6a366d2512a25a379fbe7b1f78"
+    path: ""
 - id: "SpdxDocumentFile::curl:7.70.0"
   purl: "pkg:generic/curl@7.70.0?download_url=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl%2Freleases%2Fdownload%2Fcurl-7_70_0%2Fcurl-7.70.0.tar.gz"
   cpe: "cpe:2.3:a:http:curl:7.70.0:*:*:*:*:*:*:*"
@@ -120,14 +120,14 @@ packages:
       algorithm: ""
   vcs:
     type: "Git"
-    url: "<REPLACE_VCS_URL>"
-    revision: "<REPLACE_VCS_REVISION>"
-    path: "plugins/package-managers/spdx-document-file/src/funTest/assets/projects/synthetic/cyclic-references"
+    url: "ssh://gitlab.example.com:3389/products/def.git"
+    revision: "b2c358080011af6a366d2512a25a379fbe7b1f78"
+    path: ""
   vcs_processed:
     type: "Git"
-    url: "<REPLACE_VCS_PROCESSED_URL>"
-    revision: "<REPLACE_VCS_REVISION>"
-    path: "plugins/package-managers/spdx-document-file/src/funTest/assets/projects/synthetic/cyclic-references"
+    url: "ssh://gitlab.example.com:3389/products/def.git"
+    revision: "b2c358080011af6a366d2512a25a379fbe7b1f78"
+    path: ""
 - id: "SpdxDocumentFile::zlib:1.2.11"
   purl: "pkg:generic/zlib@1.2.11?download_url=http%3A%2F%2Fzlib.net%2Fzlib-1.2.11.tar.gz"
   cpe: "cpe:/a:compress:zlib:1.2.11:::en-us"
@@ -186,11 +186,11 @@ packages:
       algorithm: ""
   vcs:
     type: "Git"
-    url: "<REPLACE_VCS_URL>"
-    revision: "<REPLACE_VCS_REVISION>"
-    path: "plugins/package-managers/spdx-document-file/src/funTest/assets/projects/synthetic/libs/openssl"
+    url: "ssh://github.com/openssl/openssl.git"
+    revision: "e2e09d9fba1187f8d6aafaa34d4172f56f1ffb72"
+    path: ""
   vcs_processed:
     type: "Git"
-    url: "<REPLACE_VCS_PROCESSED_URL>"
-    revision: "<REPLACE_VCS_REVISION>"
-    path: "plugins/package-managers/spdx-document-file/src/funTest/assets/projects/synthetic/libs/openssl"
+    url: "ssh://git@github.com/openssl/openssl.git"
+    revision: "e2e09d9fba1187f8d6aafaa34d4172f56f1ffb72"
+    path: ""

plugins/package-managers/spdx-document-file/src/funTest/assets/projects/synthetic/spdx-project-xyz-expected-output.yml

@@ -121,11 +121,11 @@ packages:
       algorithm: ""
   vcs:
     type: "Git"
-    url: "<REPLACE_VCS_URL>"
-    revision: "<REPLACE_VCS_REVISION>"
-    path: "plugins/package-managers/spdx-document-file/src/funTest/assets/projects/synthetic/libs/openssl"
+    url: "ssh://github.com/openssl/openssl.git"
+    revision: "e2e09d9fba1187f8d6aafaa34d4172f56f1ffb72"
+    path: ""
   vcs_processed:
     type: "Git"
-    url: "<REPLACE_VCS_PROCESSED_URL>"
-    revision: "<REPLACE_VCS_REVISION>"
-    path: "plugins/package-managers/spdx-document-file/src/funTest/assets/projects/synthetic/libs/openssl"
+    url: "ssh://git@github.com/openssl/openssl.git"
+    revision: "e2e09d9fba1187f8d6aafaa34d4172f56f1ffb72"
+    path: ""

plugins/package-managers/spdx-document-file/src/main/kotlin/utils/SpdxExtensions.kt

@@ -166,10 +166,10 @@ internal fun SpdxPackage.toPackage(
 ): Package {
     val packageDescription = description.ifEmpty { summary }
 
-    // If the VCS information cannot be determined from the VCS working tree itself, fall back to try getting it
-    // from the download location.
+    // The VCS information should be taken from defined download location, if not provided,
+    // get the VCS information from the working tree instead
     val packageDir = definitionFile?.resolveSibling(packageFilename)
-    val vcs = packageDir?.let { VersionControlSystem.forDirectory(it)?.getInfo() } ?: getVcsInfo().orEmpty()
+    val vcs = getVcsInfo() ?: packageDir?.let { VersionControlSystem.forDirectory(it)?.getInfo() }.orEmpty()
 
     val generatedFromRelations = doc.relationships.filter {
         it.relationshipType == SpdxRelationship.Type.GENERATED_FROM