ITADN

OSS Index now Requires Credentials

#133Openlread 创建于 2025-09-21
L
lreadcommented
## Issue [Version 12.1.5 of DependencyCheck has responded to the fact that OSS Index now requires credentials](https://github.com/dependency-check/DependencyCheck/blob/main/CHANGELOG.md#version-1215-2025-09-20). Scanning without these credentials set will fail with: ``` 2025-09-20 22:09:20,302 ERROR Engine - Exception occurred initializing Sonatype OSS Index Analyzer. ... Execution error (ExceptionCollection) at org.owasp.dependencycheck.Engine/analyzeDependencies (Engine.java:690). One or more exceptions occurred during analysis: InitializationException: Error initializing OSS Index analyzer due to missing user/password credentials. Authentication is now required: https://ossindex.sonatype.org/doc/auth-required ``` ## Thoughts Clj-watson's design of passing through env vars could make this a documentation change only. ``` CLJ_WATSON_ANALYZER_OSSINDEX_USER=<my oss index username> CLJ_WATSON_ANALYZER_OSSINDEX_PASSWORD=<my oss index password> ``` Another alternative would be to disable usage of ossindex. But since it is [enabled by default](https://github.com/dependency-check/DependencyCheck/blob/ebee56eaa8763b41857243a4e1e44256f0a37930/core/src/main/resources/dependencycheck.properties#L86), maybe not such a good idea. ## Next Steps I can take a peek, if that's helpful.
10 条评论