Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

docs: update documentation about Maven registry support #1340

Merged
merged 5 commits into from
Oct 24, 2024
Merged

docs: update documentation about Maven registry support #1340

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
6b5c4a6
docs: update documentation about Maven registry support
cuixq Oct 23, 2024
367abc4
registry example
cuixq Oct 23, 2024
4dea789
Merge branch 'main' into docs
cuixq Oct 23, 2024
65ecb8a
Update guided-remediation.md
cuixq Oct 24, 2024
d86d572
Update guided-remediation.md
cuixq Oct 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/guided-remediation.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -249,7 +249,7 @@ The following flag may be used to limit the patches allowed for your dependencie

### Data source

By default, we use the [deps.dev API](https://docs.deps.dev/api/v3alpha/) to find version and dependency information of packages during remediation.
By default, we use the [deps.dev API](https://docs.deps.dev/api/) to find version and dependency information of packages during remediation.

If instead you'd like to use your ecosystem's native registry API (e.g. `https://registry.npmjs.org`), you can use the `--data-source=native` flag. `osv-scanner fix` will attempt to use the authentication specified by the native tooling (e.g. `npm config`)

Expand Down
8 changes: 8 additions & 0 deletions docs/supported_languages_and_lockfiles.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,14 @@ After the dependency resolution, the OSV database is queried for the vulnerabili
{: .note }
Test dependencies are not supported yet in the computed dependency graph for Maven pom.xml.

### Data source

By default, we use the [deps.dev API](https://docs.deps.dev/api/v3/) to find version and dependency information of packages during transitive scanning.

If instead you'd like to fetch data from [Maven Central](https://repo.maven.apache.org/maven2/), you can use the `--experimental-resolution-data-source=native` flag.

If your project uses mirrored or private registries, in addition to setting `--experimental-resolution-data-source=native`, you will need to use the `--experimental-maven-registry=<full-registry-url>` flag to specify the registry (e.g. `--experimental-maven-registry=https://repo.maven.apache.org/maven2/`).
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unrelated to documentation, but should we name the flag --resolution-registry to be more generic? Or is it very specific to Maven?

Copy link
Contributor Author

@cuixq cuixq Oct 23, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have thought of this considering we will soon support transitive scanning for Python requirements.txt - ideally I would like to have something --resolution-registry=Maven:[URL],PyPI:[URL], but I don't have a very clear picture about how does Python private registry work so I don't want to put too much effort on finalizing this flag now, and this is also why I mark this flag as experimental. Also for the ecosystem string to be used in the flag, this should follow the spec that Gareth is working on which is also not finalized.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SGTM


## Custom Lockfiles

If you have a custom lockfile that we do not support or prefer to do your own custom parsing, you can extract the custom lockfile information and create a custom intermediate file containing dependency information so that osv-scanner can still check for vulnerabilities.
Expand Down
Loading