osv-scanner
osv-scanner copied to clipboard
Support private registries for Maven
Now by default, deps.dev API is queried for package versions and requirements when resolving dependencies.
We should also support fetching these data from private registries as well.
That would be a highly appreciated feature ;-) Right now it already fails for my most simple projects with:
failed extracting pom.xml: failed to merge parents: failed to get Maven project my.maven:super-pom:1.7.2: API query failed: Maven registry query status: 4 04 Not Found
Some updates regarding this issue:
- There is a MavenRegistryAPIClient to talk to a Maven registry directly for metadata. Currently the URL is hard-coded to Maven Central, and we would like to make this configurable.
- There is also MavenRegistryClient which can be used as a DependencyClient in dependency resolution. More work is needed to make it work with multiple-registry resolution which may involve working on deps.dev's Maven resolver.
Should this issue be closed with #1286 ?
There is one optimisation PR in progress and this can be closed after that.