Error with JavaDB

[schuman0]

Description

We are using trivy to scan images in our gitlab pipeline using the public.ecr.aws/aquasecurity/trivy:latest-arm64 image. When these scans are run we have been getting an error that it can't file the trivy-java.db library.

The runners that these pipelines execute on have full access to download the library and manually trying to download it works without any issues.

Desired Behavior

Scan completes successfully

Actual Behavior

It fails with an error with the trivy-java.db

• chmod /root/.cache/trivy/java-db/trivy-java.db: no such file or directory

Reproduction Steps

1.
2.
3.
...

Target

None

Scanner

None

Output Format

None

Mode

None

Debug Output

$ trivy image -d --no-progress --ignore-unfixed --severity CRITICAL,HIGH,MEDIUM,LOW --timeout 15m -f json -o trivy-all.json ${CI_REGISTRY_IMAGE}/${CI_COMMIT_REF_SLUG}:${CI_COMMIT_SHA}
2023-10-26T22:48:16.920Z	DEBUG	Severities: ["CRITICAL" "HIGH" "MEDIUM" "LOW"]
2023-10-26T22:48:16.921Z	DEBUG	Ignore statuses	{"statuses": ["unknown","not_affected","affected","under_investigation","will_not_fix","fix_deferred","end_of_life"]}
2023-10-26T22:48:16.926Z	DEBUG	cache dir:  /root/.cache/trivy
2023-10-26T22:48:16.926Z	DEBUG	There is no valid metadata file: unable to open a file: open /root/.cache/trivy/db/metadata.json: no such file or directory
2023-10-26T22:48:16.926Z	INFO	Need to update DB
2023-10-26T22:48:16.926Z	INFO	DB Repository: ghcr.io/aquasecurity/trivy-db
2023-10-26T22:48:16.926Z	INFO	Downloading DB...
2023-10-26T22:48:16.926Z	DEBUG	no metadata file
2023-10-26T22:48:19.361Z	DEBUG	Updating database metadata...
2023-10-26T22:48:19.362Z	DEBUG	DB Schema: 2, UpdatedAt: 2023-10-26 18:23:03.962529701 +0000 UTC, NextUpdate: 2023-10-27 00:23:03.962528401 +0000 UTC, DownloadedAt: 2023-10-26 22:48:19.36152087 +0000 UTC
2023-10-26T22:48:19.362Z	INFO	Vulnerability scanning is enabled
2023-10-26T22:48:19.362Z	DEBUG	Vulnerability type:  [os library]
2023-10-26T22:48:19.362Z	INFO	Secret scanning is enabled
2023-10-26T22:48:19.362Z	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2023-10-26T22:48:19.362Z	INFO	Please see also https://aquasecurity.github.io/trivy/v0.46/docs/scanner/secret/#recommendation for faster secret detection
2023-10-26T22:48:19.897Z	DEBUG	No secret config detected: trivy-secret.yaml
2023-10-26T22:48:19.897Z	DEBUG	The nuget packages directory couldn't be found. License search disabled
2023-10-26T22:48:19.898Z	DEBUG	No secret config detected: trivy-secret.yaml
2023-10-26T22:48:20.159Z	DEBUG	Image ID: sha256:49d6b7f6e1dac8a050baee4ba1d7a42faa9c7e62c85c9d5b1e6189ecd9ddea81
2023-10-26T22:48:20.159Z	DEBUG	Diff IDs: [sha256:5456d740f71ce2e23882740d2d87a61ad270a5ba2679dede61fd8541e4277d29 sha256:a4935d3ad56c89ebebaa7f398403d8eb48a78a71d9032107e585eb7059f921ba sha256:2ffed35cc3aab3e85f083f6b50d3f0de16d0c4629190ff6636e7e295724e77cc sha256:59e700bb59081f61c731268b2e1dc569c2154e49fac816e063ab5e1e59628bb0 sha256:12fd84f99b1cd65f07259630e35cb5ac6c37a3a7dd97db52535bccf4fde248d7 sha256:57e325698f02a3c5d642837285607f3b0657a8320ddc26abf4566588034792b1 sha256:a180f36e8d8666816700fec3d615fbc011a1c252b8b8020177f3d379fcaa931d]
2023-10-26T22:48:20.159Z	DEBUG	Base Layers: [sha256:5456d740f71ce2e23882740d2d87a61ad270a5ba2679dede61fd8541e4277d29]
2023-10-26T22:48:20.160Z	DEBUG	Missing image ID in cache: sha256:49d6b7f6e1dac8a050baee4ba1d7a42faa9c7e62c85c9d5b1e6189ecd9ddea81
2023-10-26T22:48:20.160Z	DEBUG	Missing diff ID in cache: sha256:5456d740f71ce2e23882740d2d87a61ad270a5ba2679dede61fd8541e4277d29
2023-10-26T22:48:20.160Z	DEBUG	Missing diff ID in cache: sha256:12fd84f99b1cd65f07259630e35cb5ac6c37a3a7dd97db52535bccf4fde248d7
2023-10-26T22:48:20.160Z	DEBUG	Missing diff ID in cache: sha256:a4935d3ad56c89ebebaa7f398403d8eb48a78a71d9032107e585eb7059f921ba
2023-10-26T22:48:20.160Z	DEBUG	Missing diff ID in cache: sha256:2ffed35cc3aab3e85f083f6b50d3f0de16d0c4629190ff6636e7e295724e77cc
2023-10-26T22:48:20.161Z	DEBUG	Missing diff ID in cache: sha256:59e700bb59081f61c731268b2e1dc569c2154e49fac816e063ab5e1e59628bb0
2023-10-26T22:48:20.275Z	DEBUG	Skipping directory: dev
2023-10-26T22:48:20.319Z	DEBUG	Skipping directory: proc
2023-10-26T22:48:20.319Z	DEBUG	Skipping directory: sys
2023-10-26T22:48:20.402Z	DEBUG	Missing diff ID in cache: sha256:57e325698f02a3c5d642837285607f3b0657a8320ddc26abf4566588034792b1
2023-10-26T22:48:20.535Z	DEBUG	Missing diff ID in cache: sha256:a180f36e8d8666816700fec3d615fbc011a1c252b8b8020177f3d379fcaa931d
2023-10-26T22:48:20.538Z	INFO	JAR files found
2023-10-26T22:48:20.539Z	INFO	Java DB Repository: ghcr.io/aquasecurity/trivy-java-db:1
2023-10-26T22:48:20.539Z	INFO	Downloading the Java DB...
2023-10-26T22:48:27.346Z	INFO	JAR files found
2023-10-26T22:48:27.347Z	INFO	Java DB Repository: ghcr.io/aquasecurity/trivy-java-db:1
2023-10-26T22:48:27.347Z	INFO	Downloading the Java DB...
2023-10-26T22:48:27.558Z	INFO	JAR files found
2023-10-26T22:48:27.558Z	INFO	Java DB Repository: ghcr.io/aquasecurity/trivy-java-db:1
2023-10-26T22:48:27.558Z	INFO	Downloading the Java DB...
2023-10-26T22:49:06.449Z	INFO	The Java DB is cached for 3 days. If you want to update the database more frequently, the '--reset' flag clears the DB cache.
2023-10-26T22:49:06.456Z	INFO	The Java DB is cached for 3 days. If you want to update the database more frequently, the '--reset' flag clears the DB cache.
2023-10-26T22:49:06.461Z	INFO	Analyzing JAR files takes a while...
2023-10-26T22:49:06.464Z	INFO	Analyzing JAR files takes a while...
2023-10-26T22:49:06.465Z	DEBUG	Parsing Java artifacts...	{"file": "app/libs/HikariCP-4.0.3.jar"}
2023-10-26T22:49:06.466Z	DEBUG	Parsing Java artifacts...	{"file": "app/libs/HdrHistogram-2.1.12.jar"}
2023-10-26T22:49:06.487Z	FATAL	image scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.Run
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:424
  - scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:268
  - scan failed:
    github.com/aquasecurity/trivy/pkg/commands/artifact.scan
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:685
  - failed analysis:
    github.com/aquasecurity/trivy/pkg/scanner.Scanner.ScanArtifact
        /home/runner/work/trivy/trivy/pkg/scanner/scan.go:147
  - analyze error:
    github.com/aquasecurity/trivy/pkg/fanal/artifact/image.Artifact.Inspect
        /home/runner/work/trivy/trivy/pkg/fanal/artifact/image/image.go:139
  - pipeline error:
    github.com/aquasecurity/trivy/pkg/fanal/artifact/image.Artifact.inspect
        /home/runner/work/trivy/trivy/pkg/fanal/artifact/image/image.go:243
  - failed to analyze layer (sha256:59e700bb59081f61c731268b2e1dc569c2154e49fac816e063ab5e1e59628bb0):
    github.com/aquasecurity/trivy/pkg/fanal/artifact/image.Artifact.inspect.func1
        /home/runner/work/trivy/trivy/pkg/fanal/artifact/image/image.go:230
  - post analysis error:
    github.com/aquasecurity/trivy/pkg/fanal/artifact/image.Artifact.inspectLayer
        /home/runner/work/trivy/trivy/pkg/fanal/artifact/image/image.go:312
  - post analysis error:
    github.com/aquasecurity/trivy/pkg/fanal/analyzer.AnalyzerGroup.PostAnalyze
        /home/runner/work/trivy/trivy/pkg/fanal/analyzer/analyzer.go:496
  - Unable to initialize the Java DB:
    github.com/aquasecurity/trivy/pkg/fanal/analyzer/language/java/jar.(*javaLibraryAnalyzer).PostAnalyze
        /home/runner/work/trivy/trivy/pkg/fanal/analyzer/language/java/jar/jar.go:53
  - Java DB update failed:
    github.com/aquasecurity/trivy/pkg/javadb.NewClient
        /home/runner/work/trivy/trivy/pkg/javadb/client.go:108
  - Java DB update error:
    github.com/aquasecurity/trivy/pkg/javadb.Update
        /home/runner/work/trivy/trivy/pkg/javadb/client.go:97
  - DB download error:
    github.com/aquasecurity/trivy/pkg/javadb.(*Updater).Update
        /home/runner/work/trivy/trivy/pkg/javadb/client.go:61
  - oci download error:
    github.com/aquasecurity/trivy/pkg/oci.(*Artifact).Download
        /home/runner/work/trivy/trivy/pkg/oci/artifact.go:144
  - download error:
    github.com/aquasecurity/trivy/pkg/oci.(*Artifact).download
        /home/runner/work/trivy/trivy/pkg/oci/artifact.go:192
  - failed to download:
    github.com/aquasecurity/trivy/pkg/downloader.Download
        /home/runner/work/trivy/trivy/pkg/downloader/download.go:56
  - chmod /root/.cache/trivy/java-db/trivy-java.db: no such file or directory

Operating System

trivy:latest-arm64

Version

0.46.0

Checklist

• Run trivy image --reset
• Read the troubleshooting

[knqyf263]

I believe it is the same issue as #5441. We're cutting v0.46.1 now. Please let us know v0.46.1 doesn't fix your problem.