Why nvdDatafeedUrl is not used

[marrem]

mvn help:effective-pom -Dverbose
...
        <plugin>
          <groupId>org.owasp</groupId>  <!-- net.caiw.imtang:logisticsservice-core:2.0.2-SNAPSHOT, line 266 -->
          <artifactId>dependency-check-maven</artifactId>  <!-- net.caiw.imtang:logisticsservice-core:2.0.2-SNAPSHOT, line 267 -->
          <version>9.1.0</version>  <!-- net.caiw.imtang:logisticsservice-core:2.0.2-SNAPSHOT, line 268 -->
          <configuration>
            <nvdDatafeedUrl>http://localhost:9000/nvdcve-{0}.json.gz</nvdDatafeedUrl>  <!-- net.caiw.imtang:logisticsservice-core:2.0.2-SNAPSHOT, line 270 -->
          </configuration>
        </plugin>
...

$ curl http://localhost:9000/cache.properties
#Wed May 29 00:00:45 GMT 2024
lastModifiedDate.2009=2024-05-17T17\:38\:42Z
prefix=nvdcve-
lastModifiedDate.2024=2024-05-28T23\:15\:17Z
lastModifiedDate.2002=2024-05-17T00\:20\:40Z
lastModifiedDate.2023=2024-05-28T22\:15\:10Z
...

$ mvn clean verify -P security-check
...
[INFO] --- dependency-check:9.1.0:aggregate (default) @ logisticsservice ---
[INFO] Found snapshot reactor project in aggregate for net.caiw.imtang:logisticsservice-api:2.0.2-SNAPSHOT - creating a virtual dependency as the snapshot found in the repository may contain outdated dependencies.
[INFO] Checking for updates
[INFO] NVD API has 252.032 records in this update
[INFO] Downloaded 10.000/252.032 (4%)
[INFO] Downloaded 20.000/252.032 (8%)
[INFO] Downloaded 30.000/252.032 (12%)

It is now 8:50 UTC

$ docker logs vulnz
...
172.17.0.1 - - [29/May/2024:08:48:54 +0000] "GET /cache.properties HTTP/1.1" 200 1169

So the only call to the cache server is the curl request I did to verify it's reachable.
The maven verify didn't call the nvdDatafeedUrl and uses the slow internet nvdapi.

What do I need to do to make the dependency-check-maven plugin to use the nvdDatafeedUrl?

[jeremylong]

What section of the pom is the plugin configuration in? i.e. what is the parent node of <plugin>.

[marrem]

The parent node of <plugin> is <plugins>, which in turn is in <build>.

…

Op 29 mei 2024, om 11:51 heeft Jeremy Long ***@***.***> het volgende geschreven: What section of the pom is the plugin configuration in? i.e. what is the parent node of <plugin>. — Reply to this email directly, view it on GitHub <jeremylong/DependencyCheck#6698 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAWOB5PVPHBRB5QYCAOO6S3ZEWQLRAVCNFSM6AAAAABIOPLV3OVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCMZXGAYDQMRTGI>. You are receiving this because you authored the thread.

[marrem]

What is printed to stdout when the ‘mirror’ is being used? Is it different from the ’normal’ output like: [INFO] Checking for updates [INFO] NVD API has 252.032 records in this update [INFO] Downloaded 10.000/252.032 (4%) [INFO] Downloaded 20.000/252.032 (8%) Regards, Marc Remijn

…

Op 29 mei 2024, om 11:51 heeft Jeremy Long ***@***.***> het volgende geschreven: What section of the pom is the plugin configuration in? i.e. what is the parent node of <plugin>. — Reply to this email directly, view it on GitHub <jeremylong/DependencyCheck#6698 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAWOB5PVPHBRB5QYCAOO6S3ZEWQLRAVCNFSM6AAAAABIOPLV3OVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCMZXGAYDQMRTGI>. You are receiving this because you authored the thread.

[jeremylong]

Output using the data feed looks like:

[INFO] Checking for updates
[INFO] Download Started for NVD Cache - https://dependency-check.github.io/DependencyCheck_Builder/nvd_cache/nvdcve-modified.json.gz

I'd double check that ODC is not configured somewhere else in the project - possibly the reporting section?

[marrem]

I am going to create a simple project (basic spring-boot) in which I will use the DC with cache url configured. The current project's pom is huge and composed of many poms. Although in the mvn help:effective-pom it was only present once.

[marrem]

In the simple project the dependency scan did use the cache. Went a lot faster than downloading from the nvd api. So I'll investigate the poms of the complex project that's not yet using the cache. Thanks for your quick answering.