Specify private registry (Artifactory) for Maven and Gradle dependences

[stefanstojanovskin26]

Question

Is there any way I can specify a local Artifactory URL that will be used to fetch Gradle and Maven dependences when doing a filesystem scan?

I'm not talking about scanning container images that are stored in Artifactory, but rather using a local Artifactory to resolve dependencies instead of the default URL https://repo.maven.apache.org/maven2/

I have some Gradle and Maven project with a lot of private dependencies which are not properly processed.

When doing a filesystem scan to generate SBOM in cyclonedx format, this is what I get

2025-01-24T15:48:49+01:00       DEBUG   [pom] Failed to fetch   url="https://repo.maven.apache.org/maven2/de/privateCompany/parent/master/2.0.2/master-2.0.2.pom" statusCode=404
2025-01-24T15:48:49+01:00       DEBUG   [pom] Failed to fetch   url="https://repo.maven.apache.org/maven2/de/privateCompany/parent/master/2.0.2/master-2.0.2.pom" statusCode=404
2025-01-24T15:48:49+01:00       DEBUG   [pom] Parent POM not found      artifact="com.privateCompany.parent:master:2.0.2" err="2 errors occurred:\n\t* stat /Users/me/project/pom.xml: no such file or directory\n\t* com.privateCompany.parent:master:2.0.2 was not found in local/remote repositories\n\n"
2025-01-24T15:48:49+01:00       DEBUG   [pom] Exit parent       artifact="com.privateCompany.parent:master:2.0.2"

Target

Filesystem

Scanner

None

Output Format

CycloneDX

Mode

Standalone

Operating System

macos

Version

Version: 0.58.1
Vulnerability DB:
  Version: 2
  UpdatedAt: 2025-01-21 12:15:02.404019521 +0000 UTC
  NextUpdate: 2025-01-22 12:15:02.404019301 +0000 UTC
  DownloadedAt: 2025-01-21 14:46:39.031547 +0000 UTC