epugh opened a new pull request, #4725:
URL: https://github.com/apache/solr/pull/4725
## Summary
- `./gradlew owasp` currently fails with an error from `NvdApiDataSource`
because NVD heavily rate-limits its CVE data feed for unauthenticated requests.
- Wires the `dependencyCheck { nvd { apiKey = ... } }` extension to a
`-PnvdApiKey=<key>` project property or `NVD_API_KEY` environment variable, so
the task can authenticate against NVD's API.
- Documents the requirement (and how to get a free key) in
`dev-docs/FAQ.adoc` and `dev-docs/gradle-help/workflow.txt`.
## Test plan
- [x] `./gradlew help` succeeds with no arguments
- [x] `./gradlew help -PnvdApiKey=<key>` succeeds and the property is picked
up by the extension
- [ ] `./gradlew owasp -Pvalidation.owasp=true -PnvdApiKey=<a real NVD key>`
completes an actual scan (not run here — only verified configuration wiring,
not a live NVD API call)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
