Trivy is unable to run the severity scans

[drMRI]

Description

Running the scan fails

Desired Behavior

running the scan shouldn't fail

Actual Behavior

running the scan failed

Reproduction Steps

we pull down the aquasec/trivy image to an ubuntu agent then run it with the following args
trivy_scan_args="--db-repository public.ecr.aws/aquasecurity/trivy-db:2 --quiet --format json --output security-report/trivy-scanning-report_SEVERITY.json --severity SEVERITY --exit-code 1 --debug"
this is the script where we run this 
 docker run ${docker_args} aquasec/trivy ${trivy_scan_args//SEVERITY/UNKNOWN} image ${DOCKER_IMAGE}
          FAILED_UNKNOWN=$?
          if [ $FAILED_UNKNOWN -ne 0 ]; then
            if [ $FAIL_ON_UNKNOWN -eq 1 ]; then
              echo "CVEs Found - task will fail"
              TASK_RESULT=1
            else
              echo "Unapproved CVEs Found"
            fi
          fi
          echo ""
          
          echo "Running Trivy Low Severity Scan"
          docker run ${docker_args} aquasec/trivy ${trivy_scan_args//SEVERITY/LOW} image ${DOCKER_IMAGE}
          FAILED_LOW=$?
          if [ $FAILED_LOW -ne 0 ]; then
            if [ $FAIL_ON_LOW -eq 1 ]; then
              echo "CVEs Found - task will fail"
              TASK_RESULT=1
            else
              echo "CVEs Found"
            fi
          fi
          echo ""
          
          echo "Running Trivy Medium Severity Scan"
          docker run ${docker_args} aquasec/trivy ${trivy_scan_args//SEVERITY/MEDIUM} image ${DOCKER_IMAGE}
          FAILED_MEDIUM=$?
          if [ $FAILED_MEDIUM -ne 0 ]; then
            if [ $FAIL_ON_MEDIUM -eq 1 ]; then
              echo "CVEs Found - task will fail"
              TASK_RESULT=1
            else
              echo "CVEs Found"
            fi
          fi
          echo ""
          
          echo "Running Trivy High Severity Scan"
          docker run ${docker_args} aquasec/trivy ${trivy_scan_args//SEVERITY/HIGH} image ${DOCKER_IMAGE}
          FAILED_HIGH=$?
          if [ $FAILED_HIGH -ne 0 ]; then
            if [ $FAIL_ON_HIGH -eq 1 ]; then
              echo "CVEs Found - task will fail"
              TASK_RESULT=1
            else
              echo "CVEs Found"
            fi
          fi
          echo ""
          
          echo "Running Trivy Critical Severity Scan"
          docker run ${docker_args} aquasec/trivy ${trivy_scan_args//SEVERITY/CRITICAL} image ${DOCKER_IMAGE}
          FAILED_CRITICAL=$?
          if [ $FAILED_CRITICAL -ne 0 ]; then
            if [ $FAIL_ON_CRITICAL -eq 1 ]; then
              echo "CVEs Found - task will fail"
              TASK_RESULT=1
            else
              echo "CVEs Found"
            fi
          fi
          echo ""
          
          echo "##vso[task.setvariable variable=trivyScanRan]Yes"
          exit ${TASK_RESULT}

Target

Container Image

Scanner

Vulnerability

Output Format

JSON

Mode

Standalone

Debug Output

2024-10-29T11:27:17Z	FATAL	Fatal error
  - image scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.Run
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:387
  - scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:261
  - scan failed:
    github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scan
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:622
  - failed analysis:
    github.com/aquasecurity/trivy/pkg/scanner.Scanner.ScanArtifact
        /home/runner/work/trivy/trivy/pkg/scanner/scan.go:158
(plus more that doesn't fit here)

Operating System

ubuntu inside docker

Version

latest

Checklist

• Run trivy clean --all
• Read the troubleshooting

[nikpivkin]

Hi @drMRI !

Could you please share the full output for the investigation?

[nikpivkin]

You passed the quiet and debug flags at the same time, so the logs are disabled. Most likely you have reached the pull limit for AWS ECR. #7679 (comment)

[drMRI]

GET https://ghcr.io/v2/aquasecurity/trivy-java-db/blobs/sha256:d77c4831609a044b31247565b69e1ed17bd58493341ae3c357b454973376d4dd: TOOMANYREQUESTS: retry-after: 244.2µs, allowed: 44000/minute"
is this referring to hitting the the pull limit for ECR? if that's the case is there a resolution for this ?

[nikpivkin]

I see, I didn't read the log carefully and thought it was related to ECR. This is a known problem that has a discussion #7538

[nikpivkin]

2024-10-29T11:29:18Z FATAL Fatal error json decode error: EOF

Apparently your JSON file is empty.

[drMRI]

I think this is cause from the previous failures