Running in Air Gapped environment

[mcvermeulen]

Hello everyone,

I'm running Dependency track (version 4.11.4) in an Air Gapped environment. I've updated my NVD source and that works fine. I have a large list of CVE's available.

Now i want to analyze an application which uses NuGet dependencies. So i updated the Repositories\NuGet list. I've removed nuget.org as that url is not reachable and replaced it with a mirror an several internal repositories.

However. When i upload an sbom i still see the api trying to reach nuget.org instead of the other repositories.

2024-09-18 17:17:10 2024-09-18 15:17:10,232 ERROR [NugetMetaAnalyzer] Request failure
2024-09-18 17:17:10 org.apache.http.conn.HttpHostConnectException: Connect to api.nuget.org:443 [api.nuget.org/13.107.253.67] failed: Connection refused
2024-09-18 17:17:10     at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:156)
2024-09-18 17:17:10     at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:376)

Am i missing something? How do i get it to use the listed repositories instead of the one hardcoded in NugetMetaAnalyzer.java?

Regards,
Marcel