fix(spdxdocumentfile): Get VcsInfo from downloadLocation by default

[losmateusz1]

No description provided.

[codecov]

Codecov Report

❌ Patch coverage is 0% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 58.87%. Comparing base (ffc4ebd) to head (f7eab5d).
⚠️ Report is 26 commits behind head on main.

Files with missing lines	Patch %	Lines
...ument-file/src/main/kotlin/utils/SpdxExtensions.kt	0.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff            @@
##               main   #12253   +/-   ##
=========================================
  Coverage     58.87%   58.87%           
  Complexity     1841     1841           
=========================================
  Files           362      362           
  Lines         13657    13657           
  Branches       1414     1414           
=========================================
  Hits           8041     8041           
  Misses         5106     5106           
  Partials        510      510           

Flag	Coverage Δ
funTest-external-tools	14.72% <0.00%> (+0.10%)	⬆️
test-ubuntu-26.04	43.27% <0.00%> (ø)
test-windows-2025	43.25% <0.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sschuberth]

Please provide a rationale in the commit message why it should be done that way. I guess there was a reason for the current code to work that way, also see 5294db5, which you seem to be basically reverting.

Also note that there probably is no single "right way" to do it, as it might depend on the use-case. Again, also see #8788.

[sschuberth]

as in many cases spdx files are being scanned from dedicated repositories that don't contain sources of declared components or project that is being scanned with spdx manager.

This is exactly the disputable part of the rationale, I believe, as originally the SPDX analyzer was designed to describe projects (incl. their sources) that do not use any of the known package managers.

So I believe we cannot merge this without breaking the experience for existing users. Esp. @MarcelBochtler may want to comment.

[losmateusz1]

ok, I still think that it's a little confusing that by default, ORT will always ignore downloadLocation when project VCS info is detectable, in practice there won't be possibility to get this information from downloadLocation, because in most cases you scan a project that was cloned from some repository, so better idea seems to use downloadLocation if there is any, and if all sources needs to be downloaded from project dir, downloadLocation field could be set to project repo for all components.

[sschuberth]

Esp. @MarcelBochtler may want to comment.

Also pinging @oheger-bosch, FYI.