DependencyTrack / DependencyTrack/dependency-track
Improve "Getting Started" experience by disabling NVD mirroring per default
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
Dependency-Track automatically kicks off the NVD mirroring process just one minute after it starts.
Mirroring the NVD is an expensive operation that causes large amounts of memory allocations. With the current mirroring implementation, heap size grows from ~250mb to >3gb (with `-Xmx8g`) in a very short time frame. Because we use `-XX:MaxRAMPercentage=90.0` in our Dockerfile, the JVM has a low incentive of GCing as much. Clearly we have room for improvement here, but by nature of the task itself, it will always be heavyweight.
I have heard on multiple occasions now that this behavior makes it very hard to get started, or test custom integrations locally. Spinning up DT for integration tests via [testcontainers](https://www.testcontainers.org/) is almost out of question. It is unfortunate that the first impression of DT some people have is "Wow this thing needs a lot of RAM".
While the NVD data is "nice to have", I think it's fair to say that the majority of CVEs hosted in the NVD will be irrelevant to most users. This is further amplified by the fact that most SBOMs to not contain CPEs, which means that DT will not be able to match against NVD data anyway. The NVD is the only data source enabled by default, and it is most likely the least used, due to not including PURLs.
Ideally, DT should start quickly, and not kick off any heavyweight tasks unless explicitly asked to.
At the very least, it will make DT more accessible by allowing users with "underpowered" workstations to kick the tires more easily.
### Proposed Behavior
Disable NVD mirroring by default, and require explicit opt-in to enable it. This behavior will be analog to how it's done for GHSA, OSV, and VulnDB. For existing installations, we can assume it's enabled.
Given the fact that the NVD will require usage of API keys soon (#1861), users will have to provide additional details anyway before mirroring becomes viable (it will be way too slow without API key).
Separately, revisiting potential improvements in the NVD mirroring process is also something we should do.
### Checklist
- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested
Contributor guide
Assessment
This issue has not been assessed yet.