Configure Maven search

[ghost]

Can we configure the URL of the Maven repository in Trivy?

It looks like it's set here

go-dep-parser/pkg/java/jar/parse.go

Line 29 in 5be6514

baseURL = "https://search.maven.org/solrsearch/select"

I ask for two reasons

• Maven is rate limited, using this tool on a CI server means that queries start getting blocked
• Many people/organisations have a local cache of Maven which would be faster to access from a CI server

Ideally I would like to see a CLI flag for the Trivy tool to set the an alternative repository search tool, e.g. Nexus or Artifactory.

The OWASP dependency scanning tool has the same functionality, I don't know if their implementation is useful as a reference point

https://owasp.org/www-project-dependency-check/

[scottcunningham]

I would also be interested in being able to configure this. I'm trying to run Trivy in an air-gapped environment and it's getting stuck retrying these connections forever.

Ideally we could point the checks to an internal mirror to fix the issue.