Dependencycheck: running ODC in multi module projects offline

[mahzad]

I am using ODC 3.2.1 in multimodule project offline. I used dependency-check:aggregate -X command in intellij idea .
when I run it, try to downloading some of jar files ( gson, jodatime , ...) from internet while they are in local repository....how can resolve it?

[jeremylong]

Can you share the log?

[mahzad]

The new part of log:
Failed to execute goal org.owasp.dependency-check-maven-3.2.1:aggregate on project X:goal require online mode for execution but maven currently offline.
Is it necessary to be online for aggregation goal??please help me.

[jeremylong]

That is because the mojo are currently marked as required to be online to execute:

@Mojo(
        name = "check",
        defaultPhase = LifecyclePhase.VERIFY,
        threadSafe = true,
        requiresDependencyResolution = ResolutionScope.COMPILE_PLUS_RUNTIME,
        requiresOnline = true
)

In the same setup are you able to run mvn package without being online?

[mahzad]

In root of project , I run package lifecycle without online.
I copy repo folder from nexus machine to my local machine . Is it essential to be online for aggregate goal?

[jeremylong]

atm - yes, the aggregate goal is required to be online (per the configuration above). But I'm confused as to why you are doing this in offline mode. If you have a local nexus, why can't you just configure maven to use your local nexus and just run in online mode?

[mahzad]

Connecting to internet just in specific interval is a company security policy.
For running aggregate goal ,please guide me to configure POM file.
Is it enough to set mirror in /.m2/setting.xml and nexusUrl in POM?

[jeremylong]

At the moment - if you run maven in offline ODC will not work. You can run ODC in online mode and just disable the central analyzer, configure autoupdate to false.

[lock[bot]]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.