dependency-check / dependency-check/DependencyCheck

Add a Caching Analyzer Proxy

Open
#4,150 2 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
7.7k
Forks
1.4k
Avg merge
9d 22h
Merged PRs (30d)
13

Description

**Is your feature request related to a problem? Please describe.**
We have consistent problems connecting to maven central with the analyzer, it works sometimes, but probably 60% fail rate. When it fails builds take 12 hours to complete, due to the continual failures.

**Describe the solution you'd like**
It would be great if you implemented a new Analyzer that could wrap any existing analyzer, but caches the hash->coordinates on disk. Thus only actually calling onto the destination maven server if the cache doesn't have a value for the hash. As these artifacts should be write only, the cache should be fine, altho if you want to not do this for snapshot repositories that's cool too.

**Describe alternatives you've considered**
We do use an Archiva server as a proxy locally, and we thought of implementing an Archiva Analyzer, which would solve the problem, but currently it doesn't look like Archiva has search by hash yet.

**Additional context**
The error we get at a high rate

20:56:06 [dependency-check] Could not connect to Central search. Analysis failed.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.