Maven.org Rate Limit due to scanning a large application

[gysel]

I just got locked out of search.maven.org because I was scanning a large Java application. I only get 403 Forbidden responses now.

The error I see in the debug log is:

Analysis error: jar/war/ear parse error: failed to parse WEB-INF/classes/repository-b.jar: failed to search by SHA1: status 403 Forbidden from http://search.maven.org/solrsearch/select?q=1%3A%22ad4a3a6e728fc79537d5a04edbdd884ff3651d15%22&rows=1&wt=json

Trivy then silently does not report any application vulnerabilities. I only found this problem when looking at the debug logs.

Is there a way to avoid the rate limit? Can I slow down the scan? Does anybody know what the search.maven.org rate limits are?

[masahiro331]

Is it this document?
https://central.sonatype.org/faq/403/

Can I slow down the scan?

Currently trivy hasn't slow scan option.

Other case, Sonatype seems to have a whitelist of build servers.
travis-ci/travis-ci#10053 (comment)

[vara-prasad]

We are using the latest version of v0.19.2 and seeing the below error

Analysis error: jar/war/ear parse error: failed to search by SHA1: status 403 Forbidden
from http://search.maven.org/solrsearch/select?q=1%3A%22a080d66963eaa0e3a4cabcc90a7798156b047fee%22&rows=1&wt=json

Any suggested workaround or option to use maven mirror to avoid above error ?

[github-actions]

This issue is stale because it has been labeled with inactivity.

[AkselAllas]

I have the same problem.

failed to search by SHA1: status 403 Forbidden
from http://search.maven.org/solrsearch/

Any suggested workaround or option to use maven mirror to avoid above error ?