Adding support overriding OSV source URL

[krissmed]

Tell us more.

Hi!

We are running Renovate CE self-hosted in an air-gapped environment, using the Helm chart provided here: https://github.com/mend/renovate-ce-ee.

Because the environment is air-gapped, we do not have direct access to GitHub and therefore cannot retrieve the updated OSV-offline database from the GitHub releases.

However, we do have access to GitHub and other package repositories through a secure proxy. With that in mind, I’m wondering whether it would be possible to add support for overriding the default OSV source URL so that Renovate can fetch up-to-date vulnerability data through our proxy.

While we could implement a workaround similar to this: renovatebot/osv-offline#630, it would be preferable if this were supported out of the box.

Thank you in advance!

[RahulGautamSingh]

Sounds good. @viceice Thoughts?

[viceice]

sounds good, probably easiest way is to add an environment variable to our osv DB downloader