Skip to content

Offer OSS Index user/pw for Maven #7482

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
marcelstoer opened this issue Feb 28, 2025 · 0 comments
Open

Offer OSS Index user/pw for Maven #7482

marcelstoer opened this issue Feb 28, 2025 · 0 comments

Comments

@marcelstoer
Copy link
Collaborator

marcelstoer commented Feb 28, 2025

Is your feature request related to a problem? Please describe.
Related to #4533.
The CLI and Gradle clients offer to set OSS Index user/pw. For the Maven client only the indirection through server ID and settings.xml is currently supported.

Describe the solution you'd like
For Maven, allow to either set user/pw or server ID.

I is obvious that using the server ID is usually a safer setup. However, this assumes you have access to or control over the settings.xml. This is not always the case. Example: corporate CI infrastructure with Maven settings controlled by IT.

You can still include the OSS Index for ODC safely in your pipeline if you do something like mvn -U org.owasp:dependency-check-maven:$ODC_VERSION:aggregate -DossIndexUser=$OSS_INDEX_USER ... . The actual value for $OSS_INDEX_USER would be stored as CI env variable with your project (e.g. in GitLab).

Describe alternatives you've considered
If the settings.xml isn't read-only, the pipeline might try to alter it prior to running ODC.

Additional context
@jeremylong voiced potential "endorsement" for this feature here #4533 (comment)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant