Trivy: GCR Managed Base Images failed to scan

[AdamMichaelLong]

Google has managed bases via their cloud-marketplace GCR to run and build on GCP/GKE etc

Trivy cannot scan those images, assuming because of how those images are built (Bazel)

Output of run with -debug:

trivy -d gcr.io/cloud-marketplace/google/centos7:latest
2020-02-19T11:54:26.172+1100    DEBUG   Severities: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
2020-02-19T11:54:26.173+1100    WARN    You should avoid using the :latest tag as it is cached. You need to specify '--clear-cache' option when :latest image is changed
2020-02-19T11:54:26.173+1100    DEBUG   cache dir: ~/Library/Caches/trivy
2020-02-19T11:54:26.177+1100    DEBUG   DB update was skipped because DB is the latest
2020-02-19T11:54:26.177+1100    DEBUG   DB Schema: 1, Type: 1, UpdatedAt: 2020-02-19 00:11:37.370796627 +0000 UTC, NextUpdate: 2020-02-19 12:11:37.370796227 +0000 UTC
2020-02-19T11:54:26.178+1100    DEBUG   Vulnerability type:  [os library]
2020-02-19T11:54:26.399+1100    DEBUG   OS family: centos, OS version: 7.7.1908
2020-02-19T11:54:26.401+1100    FATAL   error in image scan:
    github.com/aquasecurity/trivy/internal/standalone.run
        /home/circleci/project/internal/standalone/run.go:73
  - failed to scan the image:
    github.com/aquasecurity/trivy/pkg/scanner.Scanner.ScanImage
        /home/circleci/project/pkg/scanner/scan.go:102
  - failed to analyze OS packages:
    github.com/aquasecurity/trivy/pkg/scanner/ospkg.Scanner.Scan
        /home/circleci/project/pkg/scanner/ospkg/scan.go:43
  - Failed to analyze packages:
    github.com/aquasecurity/fanal/analyzer.init
        /go/pkg/mod/github.com/aquasecurity/[email protected]/analyzer/analyzer.go:30

Output of trivy -v:

same as above

Additional details (base image name, container registry info...):

gcr.io/cloud-marketplace/google/centos7:latest

Related issue: https://github.com/GoogleContainerTools/base-images-docker/issues/912

[knqyf263]

@AdamMichaelLong Thank you for the report! I'll take a look.

[knqyf263]

I can't pull the image. Do you have any idea?

$ docker pull gcr.io/cloud-marketplace/google/centos7:latest
Error response from daemon: unauthorized: You don't have the needed permissions to perform this operation, and you may have invalid credentials. To authenticate your request, follow the steps in: https://cloud.google.com/container-registry/docs/advanced-authentication

[masahiro331]

How to pull marketplace.gcr.io/google/centos7:latest image

Need to run the following command.
gcloud auth configure-docker && docker pull marketplace.gcr.io/google/centos7:latest

About error

Trivy needs the following files to get package information from CentOS.
https://github.com/aquasecurity/fanal/blob/master/analyzer/pkg/rpm/rpm.go#L87-L88

But these files are not present in this image. Because it was removed during the build.
https://github.com/GoogleContainerTools/base-images-docker/blob/master/centos7/build.sh#L28

I don't know how to restore Packages file.

[knqyf263]

Thanks @masahiro331. An image with no index files cannot be scanned because the list of packages is not available. Then, we have no idea of addressing it. This is not a bug but a restriction. Let me close this issue, but we reopen it if we find a way to list packages without index files.