-
Notifications
You must be signed in to change notification settings - Fork 2.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Scan tries to contact maven.org even if in air-gapped environment #1185
Comments
Related issue: #982 This happens when trivy detects jar files in an image as it requires access to the maven api for jar scanning (ref). Unfortunately, there is no way to turn this off currently and it still tries to scan jar files and connect to maven.org when run with Ideally, I could configure trivy to run in offline mode. But I would also expect that running with @knqyf263, any chance you can take a look at this in the near future? Would be super helpful! To reproduce, I ran
|
thanks @fawind have you found a workaround ? Even if the scan is less thorough. Or do I have to rollback to a version before jar scanning was introduced? If that is the case do you know the latest version not scanning jars? |
I'm not aware of a workaround. v0.17.0 added the jar scanning feature, so afaik v0.16.0 is the last version that works offline. |
We are using the latest version of v0.19.2 and seeing the below error
Any suggested workaround or option to use maven mirror ? |
Description
I'm in an air-gapped environment, I'm using this command:
But I see in logs that the scan tries connecting to the internet:
What did you expect to happen?
That the scan doesn't try connecting internet, because I don't have any.
What happened instead?
The scan tries connecting to the internet
Output of run with
-debug
:full debug log
Output of
trivy -v
:this doesn't happen with most images, but an example of when it occurs is
docker.io/library/nginx:1.19.1
The text was updated successfully, but these errors were encountered: