Air-Gapped & Offline

The scanner runs with no network access at all in local mode. It reads Intel snapshot segments from a cache directory you populate in advance, and makes no outbound calls.

Replaces TRIVY_SKIP_DB_UPDATE

Versions before v0.4.0 used TRIVY_SKIP_DB_UPDATE=true. That variable no longer does anything — use --intel-mode local instead. See the migration guide.

1. Seed the cache on a connected machine

Run a scan of a representative project — one that uses the same ecosystems as your air-gapped target — with an explicit cache directory:

CODEWARD_INTEL_CACHE=/tmp/codeward-intel \
  scan --intel-mode download

The scanner downloads only the segments the ecosystems it found require. To cover more ecosystems than that project uses, scan a directory containing a lockfile from each.

The resulting directory holds the segment databases, their checksums and manifest.json:

/tmp/codeward-intel/
  manifest.json
  core.db
  vuln-npm.db
  pkg-npm.db
  …

2. Move it across

Archive the directory and transfer it however your environment allows:

tar -czf codeward-intel-snapshot.tar.gz -C /tmp codeward-intel

Sizes to plan for (compressed download / on disk), from the August 2026 snapshot:

Ecosystem	Download	On disk
npm	~87 MB	~1.5 GB
Python	~12 MB	~149 MB
Go	~8 MB	~105 MB
All eight covered ecosystems	~120 MB	~2.0 GB

Snapshots cover npm, PyPI, Go, Maven, Cargo, RubyGems, NuGet and Composer. Other ecosystems the scanner parses get no vulnerability data offline — see Intel.

3. Scan offline

CODEWARD_INTEL_CACHE=/opt/codeward-intel \
  scan --intel-mode local

Or with Docker:

docker run --rm \
  -v /path/to/repo:/main:ro \
  -v /opt/codeward-intel:/tmp/.cache/intel-snapshots:ro \
  -e CODEWARD_INTEL_MODE=local \
  ghcr.io/codeward-io/scan:v0.4.0

local mode fails loudly if the cache is missing or unreadable — it will not silently fall back to reporting zero vulnerabilities.

Signature verification

Snapshots stay signed and verified offline: the public key is compiled into the binary, so no network call is needed to check it. A transferred cache that was corrupted or tampered with in transit fails verification rather than being scanned against.

If you run self-hosted Intel with your own signing key, point the scanner at your public key:

CODEWARD_INTEL_PUBKEY=<hex-encoded-ed25519-public-key>

Setting CODEWARD_INTEL_PUBKEY=none disables verification entirely. That is a deliberate downgrade — an unverified snapshot is a database anyone who can write to your transfer medium could have replaced.

Keeping it fresh

A snapshot older than 7 days marks the scan degraded and warns in the run summary. Re-seed on a cadence that matches your risk tolerance; the published snapshot cadence is on the Intel page.

Internal mirrors

If you can reach an internal HTTP server but not the public internet, host the snapshot files there and point the scanner at it instead of transferring archives by hand:

CODEWARD_INTEL_MIRRORS=https://artifacts.internal/codeward-intel

The mirror needs manifest.json at the base URL and each segment file alongside it — the same flat layout the GitHub Releases mirror uses.

What you give up

local mode has no access to:

• EPSS and KEV movement since the snapshot was taken
• unknown-package reporting and the package-request flow
• live risk-score recalculation

Everything else — vulnerability matching, licence detection, conflicts, policies — works identically.