Trivy fails on "with failed to download Java DB from any source" after succesful download in 0.56.0

[mgortzak]

Description

Trivy logs that downloading the Java DB was successful:

2024-10-03T13:47:06Z	INFO	[javadb] Downloading Java DB...
2024-10-03T13:47:06Z	INFO	[javadb] Downloading artifact...	repo="ghcr.io/aquasecurity/trivy-java-db:1"
2024-10-03T13:47:22Z	INFO	[javadb] Artifact successfully downloaded	repo="ghcr.io/aquasecurity/trivy-java-db:1"

This matches with these lines:

pkg/javadb/client.go#99
pkg/oci/artifact.go#228
pkg/oci/artifact.go#231

But it always throws an error:

failed to download Java DB from any source

Which matches with line:

pkg/javadb/client.go#110

Thus always failing the download even when it was successful. There seems to be a guard missing against nil on pkg/javadb/client.go#110.

Desired Behavior

The error should only occur when all downloads have failed.

Actual Behavior

The error occured when a download was successful.

Reproduction Steps

trivy image ${IMAGE_VERSION} --format json --output trivy_cve_results_image.json --no-progress --debug

Target

Container Image

Scanner

Vulnerability

Output Format

JSON

Mode

Standalone

Debug Output

+ trivy image ${IMAGE_VERSION} --format json --output trivy_cve_results_image.json --no-progress --debug
2024-10-03T13:46:55Z	DEBUG	No plugins loaded
2024-10-03T13:46:55Z	DEBUG	Default config file "file_path=trivy.yaml" not found, using built in values
2024-10-03T13:46:55Z	DEBUG	Cache dir	dir="/root/.cache/trivy"
2024-10-03T13:46:55Z	DEBUG	Cache dir	dir="/root/.cache/trivy"
2024-10-03T13:46:55Z	DEBUG	Parsed severities	severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2024-10-03T13:46:55Z	DEBUG	Ignore statuses	statuses=[]
2024-10-03T13:46:55Z	DEBUG	[vulndb] There is no valid metadata file	err="unable to open a file: open /root/.cache/trivy/db/metadata.json: no such file or directory"
2024-10-03T13:46:55Z	INFO	[vulndb] Need to update DB
2024-10-03T13:46:55Z	DEBUG	[vulndb] No metadata file
2024-10-03T13:46:55Z	INFO	[vulndb] Downloading vulnerability DB...
2024-10-03T13:46:55Z	INFO	[vulndb] Downloading artifact...	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-03T13:46:57Z	INFO	[vulndb] Artifact successfully downloaded	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-03T13:46:57Z	DEBUG	Updating database metadata...
2024-10-03T13:46:57Z	DEBUG	DB info	schema=2 updated_at=2024-10-03T12:19:10.938922191Z next_update=2024-10-04T12:19:10.93892193Z downloaded_at=2024-10-03T13:46:57.822672059Z
2024-10-03T13:46:57Z	DEBUG	[pkg] Package types	types=[os library]
2024-10-03T13:46:57Z	DEBUG	[pkg] Package relationships	relationships=[unknown root direct indirect]
2024-10-03T13:46:57Z	INFO	[vuln] Vulnerability scanning is enabled
2024-10-03T13:46:57Z	INFO	[secret] Secret scanning is enabled
2024-10-03T13:46:57Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-03T13:46:57Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-03T13:46:57Z	DEBUG	Enabling misconfiguration scanners	scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2024-10-03T13:46:57Z	DEBUG	Initializing scan cache...	type="fs"
2024-10-03T13:46:58Z	DEBUG	Credential error	err="unable to get an access token: DefaultAzureCredential: failed to acquire a token.\nAttempted credentials:\n\tEnvironmentCredential: missing environment variable AZURE_TENANT_ID\n\tWorkloadIdentityCredential: no client ID specified. Check pod configuration or set ClientID in the options\n\tManagedIdentityCredential: managed identity timed out. See https://aka.ms/azsdk/go/identity/troubleshoot#dac for more information\n\tAzureCLICredential: Azure CLI not found on path\n\tAzureDeveloperCLICredential: Azure Developer CLI not found on path"
2024-10-03T13:46:59Z	DEBUG	[secret] No secret config detected	config_path="trivy-secret.yaml"
2024-10-03T13:46:59Z	DEBUG	[secret] No secret config detected	config_path="trivy-secret.yaml"
2024-10-03T13:46:59Z	DEBUG	[image] Detected image ID	image_id="sha256:7c00a6cbc9844e45edc11b9abaf9eae077f03e9ce43b178cfe01364a78372af4"
2024-10-03T13:46:59Z	DEBUG	[image] Detected diff ID	diff_ids=[sha256:b15b682e901dd27efdf436ce837a94c729c0b78c44431d5b5ca3ccca1bed40da sha256:233f93770e00e41b7302fd22cd8cd6dc131971c2cb4a09fd7b3fd3de88b169cd sha256:39406ec23f9fd0b7b07f26e7b568614fa1be256d6d7449b0c13be24a7c643da5 sha256:a93e6b36b0c0c9e6dfcae88b3aca3b217fd53187a4e0fa7586eac3a0db1e2fe3 sha256:7cdf699c2265dbf10360f172e43369e270f76c403e2431f71f77b573f9541693 sha256:54e27da86b39ccfa1cf19acc1a46e950b032aac542525b1fef333ff184c4f7aa sha256:be7e4c1b0ce417d78a23acf9d2408e0c2e3f984c2ff6318d0b61d8eaed9bacc4]
2024-10-03T13:46:59Z	DEBUG	[image] Detected base layers	diff_ids=[sha256:b15b682e901dd27efdf436ce837a94c729c0b78c44431d5b5ca3ccca1bed40da]
2024-10-03T13:46:59Z	DEBUG	[image] Missing image ID in cache	image_id="sha256:7c00a6cbc9844e45edc11b9abaf9eae077f03e9ce43b178cfe01364a78372af4"
2024-10-03T13:46:59Z	DEBUG	[image] Missing diff ID in cache	diff_id="sha256:b15b682e901dd27efdf436ce837a94c729c0b78c44431d5b5ca3ccca1bed40da"
2024-10-03T13:46:59Z	DEBUG	[image] Missing diff ID in cache	diff_id="sha256:39406ec23f9fd0b7b07f26e7b568614fa1be256d6d7449b0c13be24a7c643da5"
2024-10-03T13:46:59Z	DEBUG	[image] Missing diff ID in cache	diff_id="sha256:7cdf699c2265dbf10360f172e43369e270f76c403e2431f71f77b573f9541693"
2024-10-03T13:46:59Z	DEBUG	[image] Missing diff ID in cache	diff_id="sha256:a93e6b36b0c0c9e6dfcae88b3aca3b217fd53187a4e0fa7586eac3a0db1e2fe3"
2024-10-03T13:46:59Z	DEBUG	[image] Missing diff ID in cache	diff_id="sha256:233f93770e00e41b7302fd22cd8cd6dc131971c2cb4a09fd7b3fd3de88b169cd"
2024-10-03T13:47:00Z	DEBUG	[image] Missing diff ID in cache	diff_id="sha256:54e27da86b39ccfa1cf19acc1a46e950b032aac542525b1fef333ff184c4f7aa"
2024-10-03T13:47:00Z	DEBUG	[image] Missing diff ID in cache	diff_id="sha256:be7e4c1b0ce417d78a23acf9d2408e0c2e3f984c2ff6318d0b61d8eaed9bacc4"
2024-10-03T13:47:06Z	DEBUG	[dpkg] Unable to parse the available file	file_path="var/lib/dpkg/available" err="file open error: open var/lib/dpkg/available: file does not exist"
2024-10-03T13:47:06Z	INFO	[javadb] Downloading Java DB...
2024-10-03T13:47:06Z	INFO	[javadb] Downloading artifact...	repo="ghcr.io/aquasecurity/trivy-java-db:1"
2024-10-03T13:47:22Z	INFO	[javadb] Artifact successfully downloaded	repo="ghcr.io/aquasecurity/trivy-java-db:1"
2024-10-03T13:47:22Z	DEBUG	[jar] Parsing Java artifacts...	file_path="opt/java/openjdk/lib/jrt-fs.jar"
2024-10-03T13:47:22Z	DEBUG	[jar] No such POM in the central repositories	file="jrt-fs.jar"
2024-10-03T13:47:22Z	FATAL	Fatal error
  - image scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.Run
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:387
  - scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:261
  - scan failed:
    github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scan
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:622
  - failed analysis:
    github.com/aquasecurity/trivy/pkg/scanner.Scanner.ScanArtifact
        /home/runner/work/trivy/trivy/pkg/scanner/scan.go:158
  - analyze error:
    github.com/aquasecurity/trivy/pkg/fanal/artifact/image.Artifact.Inspect
        /home/runner/work/trivy/trivy/pkg/fanal/artifact/image/image.go:126
  - pipeline error:
    github.com/aquasecurity/trivy/pkg/fanal/artifact/image.Artifact.inspect
        /home/runner/work/trivy/trivy/pkg/fanal/artifact/image/image.go:230
  - failed to analyze layer (sha256:be7e4c1b0ce417d78a23acf9d2408e0c2e3f984c2ff6318d0b61d8eaed9bacc4):
    github.com/aquasecurity/trivy/pkg/fanal/artifact/image.Artifact.inspect.func1
        /home/runner/work/trivy/trivy/pkg/fanal/artifact/image/image.go:217
  - post analysis error:
    github.com/aquasecurity/trivy/pkg/fanal/artifact/image.Artifact.inspectLayer
        /home/runner/work/trivy/trivy/pkg/fanal/artifact/image/image.go:299
  - post analysis error:
    github.com/aquasecurity/trivy/pkg/fanal/analyzer.AnalyzerGroup.PostAnalyze
        /home/runner/work/trivy/trivy/pkg/fanal/analyzer/analyzer.go:510
  - Unable to initialize the Java DB:
    github.com/aquasecurity/trivy/pkg/fanal/analyzer/language/java/jar.(*javaLibraryAnalyzer).PostAnalyze
        /home/runner/work/trivy/trivy/pkg/fanal/analyzer/language/java/jar/jar.go:49
  - Java DB update failed:
    github.com/aquasecurity/trivy/pkg/javadb.NewClient
        /home/runner/work/trivy/trivy/pkg/javadb/client.go:149
  - OCI artifact error:
    github.com/aquasecurity/trivy/pkg/javadb.(*Updater).Update
        /home/runner/work/trivy/trivy/pkg/javadb/client.go:63
  - failed to download Java DB from any source:
    github.com/aquasecurity/trivy/pkg/javadb.(*Updater).downloadDB
        /home/runner/work/trivy/trivy/pkg/javadb/client.go:110

Operating System

Ubuntu 22.04

Version

+ trivy --version
Version: 0.56.0

Checklist

• Run trivy clean --all
• Read the troubleshooting

[mgortzak]

So after I wrote this all up my colleague mentioned #7646 and aquasecurity/trivy-java-db#44. Good to know it is fixed already in #7652!

[iMilad]

I get this issue with latest version v0.65.2

2024-10-29T14:12:16Z INFO [vulndb] Need to update DB 2024-10-29T14:12:16Z INFO [vulndb] Downloading vulnerability DB... 2024-10-29T14:12:16Z INFO [vulndb] Downloading artifact... repo="ghcr.io/aquasecurity/trivy-db:2" 2024-10-29T14:12:17Z ERROR [vulndb] Failed to download artifact repo="ghcr.io/aquasecurity/trivy-db:2" err="oci download error: failed to fetch the layer: GET https://ghcr.io/v2/aquasecurity/trivy-db/blobs/sha256:320914da559de0d07f6a038e6383859c67753610e026aaa354b8651027f5b94a: TOOMANYREQUESTS: retry-after: 451.743µs, allowed: 44000/minute" 2024-10-29T14:12:17Z FATAL Fatal error init error: DB error: failed to download vulnerability DB: OCI artifact error: failed to download vulnerability DB: failed to download artifact from any source