版本信息：
osv-scanner version: 2.3.1
osv-scalibr version: 0.4.0
commit: d03774202cbaf17a260c2f4a073585baee524b45
built at: 2025-12-11T05:34:53Z
准备了一个离线库下载脚本download_osv_db/main.go，下载的离线库结构如下：
osv-scanner
    ├─Cargo
    ├─crates.io
    │      all.zip 
    ├─Go
    │      all.zip
    ├─Maven
    │      all.zip
    ├─npm
    │      all.zip
    ├─NuGet
    │      all.zip
    ├─Packagist
    │      all.zip 
    └─PyPI
           all.zip
在项目中使用osv-scanner是通过使用OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY环境变量找到离线库位置；

手动验证部分
# 需要下载osv-scanner二进制
go get github.com/google/osv-scanner/cmd/osv-scanner@latest

go get github.com/go-enry/go-enry/v2

# 离线库
https://osv-vulnerabilities.storage.googleapis.com/Go/all.zip
https://osv-vulnerabilities.storage.googleapis.com/npm/all.zip
https://osv-vulnerabilities.storage.googleapis.com/Maven/all.zip
https://osv-vulnerabilities.storage.googleapis.com/PyPI/all.zip
https://osv-vulnerabilities.storage.googleapis.com/Packagist/all.zip

# 设置环境变量
set OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY=G:\share\goodjob\sca_up\osv_cache

# echo %OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY%
G:\share\goodjob\sca_up\osv_cache
# 测试
osv-scanner.exe --offline G:\share\goodjob\sca_up\shared-data\source\govwa-master

# 版本
Version: 0.68.2
Java DB:
  Version: 1
  UpdatedAt: 2026-01-04 01:20:21.119694708 +0000 UTC
  NextUpdate: 2026-01-07 01:20:21.119694397 +0000 UTC
  DownloadedAt: 2026-01-04 07:42:50.4710723 +0000 UTC
# 目录结构
├─db
│      metadata.json
│      trivy.db
└─java-db
        metadata.json
        trivy-java.db

# 下载离线库命令
trivy.exe image --download-db-only ^
  --cache-dir "G:\share\goodjob\sca_up\trivy_cache" ^
  --db-repository ghcr.m.daocloud.io/aquasecurity/trivy-db:2

trivy.exe image --download-java-db-only ^
  --cache-dir "G:\share\goodjob\sca_up\trivy_cache" ^
  --java-db-repository ghcr.m.daocloud.io/aquasecurity/trivy-java-db:1
        
# 使用离线库检测
trivy.exe fs "G:\share\goodjob\sca_up\shared-data\source\vuln-demo" ^
  --cache-dir "G:\share\goodjob\sca_up\trivy_cache" ^
  --offline-scan ^
  --skip-db-update ^
  --skip-java-db-update ^
  --skip-check-update ^
  --format json ^
  --output trivy_result.json
  
# 检测二进制
trivy rootfs "G:\share\goodjob\sca_up\shared-data\source\vuln-demo\vuln-demo.exe" ^
  --cache-dir "G:\share\goodjob\sca_up\trivy_cache" ^
  --offline-scan ^
  --skip-db-update ^
  --skip-java-db-update ^
  --format json ^
  --output binary_result.json

# 部署 docker-compose
docker pull ghcr.io/joernio/joern:nightly

docker-compose up -d
docker-compose down
# 生成统一图
docker exec joern-engine joern --script /app/scripts/visualize.sc --param inputPath=/app/source/vuln-demo --param outFile=/app/output/graph.dot