Trivy Database downloading failed randomly

[Dhee123]

Description

We are using trivy for scanning repos to finding vulnerabilities, for that we are using trivy go binary with version 0.54.0 and then while downloading we getting this error as attached below:

Desired Behavior

It should download Trivy successfully and start the scanning process.

Actual Behavior

Getting Error related metadata file not found (There is no valid metadata file err="unable to open a file: open /home/jenkins/.cache/trivy/db/metadata.json: no such file or directory")

Reproduction Steps

1.Run Trivy using Trivy go-binary 0.54.0
2. Trivy downloading start
3. Trivy failed with fatel error
...

Target

Filesystem

Scanner

Vulnerability

Output Format

Table

Mode

None

Debug Output

2024-09-30T09:21:02Z	DEBUG	There is no valid metadata file	err="unable to open a file: open /home/jenkins/.cache/trivy/db/metadata.json: no such file or directory"
2024-09-30T09:21:02Z	INFO	[db] Need to update DB
2024-09-30T09:21:02Z	INFO	[db] Downloading DB...	repository="ghcr.io/aquasecurity/trivy-db:2"
2024-09-30T09:21:02Z	DEBUG	No metadata file

2024-09-30T09:21:02Z	FATAL	Fatal error
  - init error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.Run
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:358
  - DB error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.NewRunner
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:119
  - failed to download vulnerability DB:
    github.com/aquasecurity/trivy/pkg/commands/operation.DownloadDB
        /home/runner/work/trivy/trivy/pkg/commands/operation/operation.go:41
  - database download error:
    github.com/aquasecurity/trivy/pkg/db.(*Client).Download
        /home/runner/work/trivy/trivy/pkg/db/db.go:162
  - OCI repository error:
    github.com/aquasecurity/trivy/pkg/oci.(*Artifact).populate
        /home/runner/work/trivy/trivy/pkg/oci/artifact.go:93
  - 1 error occurred:
	* GET https://ghcr.io/v2/aquasecurity/trivy-db/manifests/2: TOOMANYREQUESTS: retry-after: 766.038µs, allowed: 44000/minute

Operating System

Linux

Version

0.54.0

Checklist

• Run trivy clean --all
• Read the troubleshooting

[knqyf263]

Duplicate #7538

[Dhee123]

Hi @knqyf263 , Regarding Db use - awsDb , is this db is same as used by trivy by default and is it safe to use ? One more thing is it properly updated or in sync with updates of default trivy db and does this ECR image would be available permanently or at least for a long time?

[knqyf263]

They are the same. We don't plan to delete it for now, but we'll announce our decision if we do.