search

jeremylong / DependencyCheck

OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.
https://owasp.org/www-project-dependency-check/
Apache License 2.0
6.43k stars 1.28k forks source link

Add a Caching Analyzer Proxy #4150

Open mebigfatguy opened 2 years ago

mebigfatguy commented 2 years ago

Is your feature request related to a problem? Please describe. We have consistent problems connecting to maven central with the analyzer, it works sometimes, but probably 60% fail rate. When it fails builds take 12 hours to complete, due to the continual failures.

Describe the solution you'd like It would be great if you implemented a new Analyzer that could wrap any existing analyzer, but caches the hash->coordinates on disk. Thus only actually calling onto the destination maven server if the cache doesn't have a value for the hash. As these artifacts should be write only, the cache should be fine, altho if you want to not do this for snapshot repositories that's cool too.

Describe alternatives you've considered We do use an Archiva server as a proxy locally, and we thought of implementing an Archiva Analyzer, which would solve the problem, but currently it doesn't look like Archiva has search by hash yet.

Additional context The error we get at a high rate

20:56:06 [dependency-check] Could not connect to Central search. Analysis failed.

jeremylong commented 2 years ago

The Maven Central data is already cached... Maybe we should increase the cache TTL...

https://github.com/jeremylong/DependencyCheck/blob/2d4163918f2392628f29ce309739f90efd78fc99/core/src/main/resources/dependencycheck-cache.properties#L26-L27

mebigfatguy commented 2 years ago

This is seconds i take it? so i take it that's a 1 month cache time? That seems, .... hard to believe... Maybe our servers are getting repaved or something and we lose that cache. Hmmm, don't think so, but i'll check.

Thanks!