Scanning of Java App in Airgap Environment

[leopold2410]

Hi,
I tried to use trivy image scan in standalone mode in a gitlab CI Runner. The environment is air-gapped.
The scan is executed on a OCI tarball produced with kaniko.
The scan starts as expected (the configured cached offline DB seems to work), but then issues a lot of HTTP requests to search.maven.org and finally I got:

2021-06-09T17:35:59.540Z DEBUG request failed {"error": "Get "http://search.maven.org/solrsearch/select?q=g%3A%22org.hibernate%22+AND+a%3A%22hibernate-commons-annotations%22&rows=1\": dial tcp: lookup search.maven.org on 10.43.0.10:53: no such host", "method": "GET", "url": "http://search.maven.org/solrsearch/select?q=g%3A%22org.hibernate%22+AND+a%3A%22hibernate-commons-annotations%22&rows=1"}
2021-06-09T17:35:59.540Z DEBUG retrying request {"request": "GET http://search.maven.org/solrsearch/select?q=g%3A%22org.hibernate%22+AND+a%3A%22hibernate-commons-annotations%22&rows=1", "timeout": "2m40s", "remaining": 2}
2021-06-09T17:38:38.241Z FATAL scan error:
github.com/aquasecurity/trivy/pkg/commands/artifact.runWithTimeout
/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:67

• image scan failed:
  github.com/aquasecurity/trivy/pkg/commands/artifact.scan
  /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:163
• failed analysis:
  github.com/aquasecurity/trivy/pkg/scanner.Scanner.ScanArtifact
  /home/runner/work/trivy/trivy/pkg/scanner/scan.go:98
• analyze error:
  github.com/aquasecurity/fanal/artifact/image.Artifact.Inspect
  /home/runner/go/pkg/mod/github.com/aquasecurity/[email protected]/artifact/image/image.go:95
• timeout:
  github.com/aquasecurity/fanal/artifact/image.Artifact.inspect
  /home/runner/go/pkg/mod/github.com/aquasecurity/[email protected]/artifact/image/image.go:158
• context deadline exceeded

The timeout parameter is not really an option (I already used 30m) because of the exponential back-off strategy on each of these search requests.
Is there any option to turn off network requests completely?

Best regards,
Leo

[knqyf263]

Currently, Java scanning requires Internet access. And, we don't have an option to turn it off.

[leopold2410]

Is there any workaround? Can I use a maven mirror?
I tried as well the --skip-dirs option and excluded the directory of my java app, but it did not work for me when I scanned an OCI image in tar format. The java scanner seems to ignore this option.

[sherif84]

+1 . we are facing the same issue . we need to be able to scan java components in an airgap environment since our CI servers sit behind a corporate firewall and are blocked from the internet . we have some servers with limited internet access (https/443) only . and these also failed since in java scans it is reaching out to http/80 endpoints

2021-06-26T22:21:40.702Z	DEBUG	request failed	{"error": "Get \"http://search.maven.org/solrsearch/select?q=1%3A%22bcbef4c5c9d6607d7105994f65ced57780233fb6%22&rows=1&wt=json\": dial tcp 54.210.224.153:80: i/o timeout", "method": "GET", "url": "http://search.maven.org/solrsearch/select?q=1%3A%22bcbef4c5c9d6607d7105994f65ced57780233fb6%22&rows=1&wt=json"}

any suggestions of a workaround with a local maven mirror for an airgap run ?
or a way even ensure trivy only reaches out to https since http://search.maven.org/ is also available in https://search.maven.org/

[github-actions]

This issue is stale because it has been labeled with inactivity.

[vara-prasad]

+1. We are facing same issue as below

Analysis error: jar/war/ear parse error: failed to search by SHA1: status 403 Forbidden
from http://search.maven.org/solrsearch/select?q=1%3A%22a080d66963eaa0e3a4cabcc90a7798156b047fee%22&rows=1&wt=json

Any suggested workaround or option to use maven mirror ?

[leopold2410]

Hi,
the only workaround I found was stepping back to version 0.16.0 of the scanner.

Best regards,
Leo

[vara-prasad]

Hi @leopold2410 , jar scan is added from v0.17.0 and since we would like to scan jars, going back to v0.16.0 is not a feasible option for us.

[Orrimp]

+1 Same problem. We decided to go back to 0.16 but it's a BAD solution.
Manual timeout for this GET or redirect to use .m2/settings.xml maven repo URL would help

[knqyf263]

Thanks for your patience. v0.20.0 is finally out. You can use --skip-files or --skip-dirs. Or, you can also disable the scanning of language-specific dependencies with --vuln-type os.

[lemonprogis]

I'd rather us know it failed to reach out. Right now it just acts like a clear scan. That's mildly frustrating when you are trying to trust this tool.