How to use properly use ENVs TRIVY_DB_REPOSITORY and TRIVY_JAVA_DB_REPOSITORY for multiple locations.

[sbirl]

Description

Trying to make changes to how my colleagues and I run Trivy (v0.56.2) in our environment because of Issue #7699. Based what Ive seen from the discussions in 7668, I thought the two ENVs were comma-separated. However, as reported further in that thread Trivy gives up after the first repo hits the rate limit.

I searched high and low for other examples of how to use TRIVY_DB_REPOSITORY and TRIVY_JAVA_DB_REPOSITORY (or by extension --db-repository and --java-db-repository if my colleagues and I need to try that), but there does not seem to be any clear-cut explanation on how to properly pass along multiple database locations at the commandline.

Or maybe I missed it the doc I looked at?

Link

https://aquasecurity.github.io/trivy/v0.56/docs/references/configuration/config-file/#db-options

Suggestions

Usage examples.

[simar7]

If you're specifying in the trivy config yaml file, then a list should work. If it's via the command line params, then a comma separated list is expected. Did you try those? cc @nikpivkin

[sbirl]

No, we're not using the YAML config file. It's all commandline args with the ENVs.

Good know that it is comma-separated, but then that means Trivy gave up after trying the first database location and never tried the other three I specified.