official list of the external URLs called by DT

[quentingosset]

Hello everyone,

I am currently setting up Dependency-Track within my company, but we are operating behind a proxy with an address whitelisting system. So far, I’ve encountered some issues related to the proxy: Dependency-Track downloads various resources in the background (NIST, Sonatype, etc.), but I have not been able to find a complete and official list of the external URLs or services the application relies on.

To avoid having the proxy team identify URLs to whitelist one by one, someone could provide me an exhaustive list of all external resources used by Dependency-Track?
This would help us properly configure our network environment and ensure the application runs smoothly.

Thank you in advance for your assistance.

[nscuro]

We ship this information as part of our BOM, refer to the services section: https://github.com/DependencyTrack/dependency-track/releases/download/4.13.6/bom.json

[quentingosset]

Thanks a lot.

[worming004]

I've made a walk 3 weeks ago in the code and found few extra domain names that are not in the bom file

• api.kennasecurity.com
• channels.nixos.org
• cyclonedx.github.io
• epss.cyentia.com (respond with redirection to domain epss.empiricalsecurity.com)
• fastapi.metacpan.org
• github.com
• hackage.haskell.org
• nvlpubs.nist.gov
• services.nvd.nist.gov
• spdx.github.io

I have no idea if these domains are really used or in which context these domains are used