Trivy: Issue with Google Cloud Container registry

Created on 14 Nov 2019 · 7Comments · Source: aquasecurity/trivy

Description

I integrated trivy inside one of my gitlab pipeline.

docker run --rm  -v /tmp:/tmp -e TRIVY_USERNAME='' -e GOOGLE_APPLICATION_CREDENTIALS=/tmp/RANDOM.json -v $HOME/Library/Caches:/root/.cache/ aquasec/trivy:0.1.7 --debug eu.gcr.io/PROJECT/IMAGE

Not sure if this issue is related wih https://github.com/aquasecurity/trivy/issues/254 or not :)

What did you expect to happen?

Trivy is able to extract and analyze my image.

What happened instead?

Some obscure error (will look into the go code after submitting this issue).

Output of run with -debug:

Unable to find image 'aquasec/trivy:0.1.7' locally
0.1.7: Pulling from aquasec/trivy
Digest: sha256:766f555c28be81f49046ab6983d98af9d507518221ccf4f6a7d5ca9baebe9260
Status: Downloaded newer image for aquasec/trivy:0.1.7
2019-11-14T14:14:11.824Z    DEBUG   cache dir:  /root/.cache/trivy
2019-11-14T14:14:11.826Z    DEBUG   db path: /root/.cache/trivy/db/trivy.db
2019-11-14T14:14:11.847Z    INFO    Updating vulnerability database...
2019-11-14T14:14:11.849Z    DEBUG   git pull
2019-11-14T14:14:12.956Z    DEBUG   total updated files: 1
2019-11-14T14:14:12.959Z    DEBUG   Vulnerability type:  [os library]
2019-11-14T14:14:14.164Z    FATAL   error in image scan:
    github.com/aquasecurity/trivy/pkg.Run
        /home/circleci/project/pkg/run.go:168
  - failed to analyze image:
    github.com/aquasecurity/trivy/pkg/scanner.ScanImage
        /home/circleci/project/pkg/scanner/scan.go:38
  - failed to extract files:
    github.com/aquasecurity/fanal/analyzer.Analyze
        /go/pkg/mod/github.com/aquasecurity/[email protected]/analyzer/analyzer.go:131
  - failed to extract files:
    github.com/aquasecurity/fanal/extractor/docker.DockerExtractor.Extract
        /go/pkg/mod/github.com/aquasecurity/[email protected]/extractor/docker/docker.go:231
  - failed to extract the archive:
    github.com/aquasecurity/fanal/extractor/docker.DockerExtractor.ExtractFiles
        /go/pkg/mod/github.com/aquasecurity/[email protected]/extractor/docker/docker.go:341
  - unexpected EOF

Output of trivy -v:

0.1.7

Additional details (base image name, container registry info...):

registry: eu.gcr.io

"DockerVersion": "19.03.4",
"Architecture": "amd64",
"Os": "linux",
"Size": 1826345489,
"VirtualSize": 1826345489,
"GraphDriver": {
  "Name": "overlay2
}

(yep the image is big)

kinbug

Source

FGRibreau

All 7 comments

Please provide a way to duplicate the problem. It would be best to have some publicly available image that repeatably causes this when scanned. Looking at the code it seems more like a malformed download than anything else.

jabielecki on 16 Nov 2019

@FGRibreau Would you use v0.2.1 and try --timeout 30m?

knqyf263 on 17 Nov 2019

2019-11-17T12:33:19.530Z    WARN    --only-update, --refresh and --auto-refresh are unnecessary and ignored now. These commands will be removed in the next version.
168 2019-11-17T12:33:21.277Z    INFO    Reopening vulnerability DB
169 2019-11-17T12:33:22.573Z    FATAL   error in image scan: failed to analyze image: failed to extract files: failed to get the v2 manifest: Get https://eu.gcr.io/v2/PROJECT/IMAGE/manifests/ci-check-docker-image-a2f230bf5aa58ab8ef9a37293382de1dbae8c519: http: non-successful response (status=401 body="{\"errors\":[{\"code\":\"UNAUTHORIZED\",\"message\":\"You don't have the needed permissions to perform this operation, and you may have invalid credentials. To authenticate your request, follow the steps in: https://cloud.google.com/container-registry/docs/advanced-authentication\"}]}")

Note : the service-account I use exposed behind GOOGLE_APPLICATION_CREDENTIALS has "editor" access to GCP.

FGRibreau on 17 Nov 2019

Switched to -e TRIVY_AUTH_URL=${DOCKER_REGISTRY} -e TRIVY_USERNAME=oauth2accesstoken -e TRIVY_PASSWORD=${GCLOUD_ACCESS_TOKEN} (cf oauth token) and it now works :+1:

FGRibreau on 17 Nov 2019

🎉1

Switched to -e TRIVY_AUTH_URL=${DOCKER_REGISTRY} -e TRIVY_USERNAME=oauth2accesstoken -e TRIVY_PASSWORD=${GCLOUD_ACCESS_TOKEN} (cf oauth token) and it now works 👍

What did you fill in with DOCKER_REGISTRY? the gcr.io registry?

I'm also having issues getting this to work with GCR.
(It's tossed in a Makefile)
+docker run \ --rm \ -v $$HOME:/root/.cache/ \ -v $$GOOGLE_APPLICATION_CREDENTIALS:/root/application_default_credentials.json \ -e GOOGLE_APPLICATION_CREDENTIALS=/root/application_default_credentials.json \ aquasec/trivy \ gcr.io/myproject/link/to/image:version

jose-bonilla on 18 Dec 2019

Good day! What should the final string/command look like for a container scan in Google Registry?
For example, using Docker

nbublikov on 28 Jul 2020

👍1

Switched to -e TRIVY_AUTH_URL=${DOCKER_REGISTRY} -e TRIVY_USERNAME=oauth2accesstoken -e TRIVY_PASSWORD=${GCLOUD_ACCESS_TOKEN} (cf oauth token) and it now works 👍

Using Access Token still doesn't work if you need to authenticate with Google Artifact Registry and scan images like us-docker.pkg.dev/foo/bar/myImage:1.0.0
We need the Standalone Credentials Helper docker-credential-gcr
Check out a solution in : https://github.com/aquasecurity/trivy/issues/783