Scanning takes too long after adding the --dependency-tree option

[zangcc]

Description

Hello trivy, after I added the --dependency-tree option to trivy0.45.0, the scanning time became very long, sometimes it even took more than 3 hours to complete the scan. In previous versions without this option, the average time was probably around 8 minutes.

Is there any way to improve the long time-consuming problem of the --dependency-tree option? Can recursive algorithms be optimized?

By the way, let me share the command I used:

./trivy fs --severity HIGH,CRITICAL --dependency-tree /path/to/project -o demo1.txt

The project I scanned is a java project based on maven

Target

None

Scanner

None

[zangcc]

I tried updating to 0.46.0 and found that running the same project on a linux64bit server only takes about 1 minute.

However, when running on my local machine, macOS, it is the same as the previous version, very slow. Is there any time difference between the macOS version and the Linux version when you test it?

[DmitriyLewen]

Hello @zangcc
Thanks for your report!

I tried to reproduce your case, but got similar time in both cases:

trivy fs ./pom.xml  7.88s user 1.36s system 4% cpu 3:40.09 total
trivy fs --dependency-tree ./pom.xml  7.71s user 1.43s system 4% cpu 3:38.22 total

Can you share your pom.xml file to investigation your issue?

Regards, Dmitriy

[DmitriyLewen]

Can you also indicate what CPU is installed on your Mac?

[zangcc]

thank you for your reply. Later I added the --offline-scan option, and the speed was reduced from the original 1-2 hours to less than half a minute or even faster. I wonder if this scan is related to the local network speed?

[DmitriyLewen]

I think i understand what happened:
You pom.xml file contains a lot of dependencies, but it looks like you haven't saved/loaded thщse dependencies into local PC.
That is why Trivy addresses to Maven repository for every dependency.
If you have low network connection speed - this can greatly increase the operating time.
Also it explains why --offline-scan flag helps - with this flag Trivy checks only local dependencies.
But you need to understand that you can skip some dependencies when using --offline-scan flag.
https://aquasecurity.github.io/trivy/v0.46/docs/coverage/language/java/#pomxml