我使用带有OWASP插件的maven项目来检查CI拉取请求中每个提交的漏洞。

<plugin>
                        <groupId>org.owasp</groupId>
                        <artifactId>dependency-check-maven</artifactId>
                        <version>${version.dependency-check-maven}</version>
                        <executions>
                            <execution>
                                <goals>
                                    <goal>aggregate</goal>
                                </goals>
                                <phase>verify</phase>
                            </execution>
                        </executions>
                        <configuration>
                            <showSummary>true</showSummary>
                            <!-- this will work only in the top-level maven module -->
                            <suppressionFile>${user.dir}/owasp-suppressions.xml</suppressionFile>
                            <format>ALL</format>
                            <failBuildOnAnyVulnerability>true</failBuildOnAnyVulnerability>
                            <!-- alternative: fail on level (High starts at 7, Critical at 9) -->
                            <!-- <failBuildOnCVSS>4</failBuildOnCVSS> -->
                            <assemblyAnalyzerEnabled>false</assemblyAnalyzerEnabled>
                            <cveUrlModified>address of the NVD local mirror</cveUrlModified>
                            <cveUrlBase>address of the NVD local mirror</cveUrlBase>
                            <cveWaitTime>1</cveWaitTime> <!--value in milliseconds, default is 4000-->
                        </configuration>
                    </plugin>

对于CI构建，我使用PROW -https://docs.prow.k8s.io/docs/overview/对于本地镜像方法，此处描述https://jeremylong.github.io/DependencyCheck/data/mirrornvd.html，并从此处使用镜像https://github.com/stevespringett/nist-data-mirror/
从镜像下载CVE的过程仍然需要相当多的时间（大约3分钟）。从日志中我可以看到大部分时间都花在下载CVE上

[INFO] Download Started for NVD CVE - 2003
[INFO] Download Complete for NVD CVE - 2003  (5 ms)
[INFO] Processing Started for NVD CVE - 2003
[INFO] Processing Complete for NVD CVE - 2002  (4608 ms)
[INFO] Processing Complete for NVD CVE - 2003  (1131 ms)
...

还有做一些数据库维护

[INFO] Begin database maintenance
[INFO] Updated the CPE ecosystem on 128773 NVD records
[INFO] Removed the CPE ecosystem on 3604 NVD records
[INFO] End database maintenance (13482 ms)
[INFO] Begin database defrag
[INFO] End database defrag (3765 ms)
[INFO] Check for updates complete (112132 ms)

你知道什么技巧来加快OWASP检查？