Trivy: 0.5.0 fails in Gitlab Pipeline

[webmutation]

Previous version 0.4.4 worked well, today version 0.5.0 is breaking all scans return

./trivy --exit-code 0 --cache-dir $CI_PROJECT_DIR/.trivycache/ --no-progress $CI_REGISTRY/$PKG:$PKG_VERSION
2020-03-05T15:38:56.477Z FATAL error in image scan: failed analysis: analyze error: failed to analyze layer: sha256:74062818ac91f46ee51b59f32aac690c4de14c9a6b9185a28cce084fb89233d1 : failed to get packages: failed to get packages: no rpm command

from a gitlab pipeline run, if its relevant

[m-wynn]

I was able to fix this by installing rpm in our CI container (it's packaged for alpine).
However this is not ideal, as I am not scanning any RHEL-based containers. I also feel this should have been communicated in the release notes.

[webmutation]

Hi not sure I understand you changed your builder image?
I will just revert back to 0.4.4 for the time being.

[knqyf263]

@webmutation Are you scanning RHEL based image? Actually, I didn't change our image at all.

[knqyf263]

@m-wynn What did you scan? And how did you scan? The following commands work in my environment.

$ trivy alpine:3.10
$ trivy centos:7
$ docker run --rm -it aquasec/trivy:0.5.0 alpine:3.10
$ docker run --rm -it aquasec/trivy:0.5.0 centos:7

[bgoareguer]

Same for me with trivy 0.5.1 (unpacked from tarball on an Ubuntu 18.04 machine):
$ ./trivy ubuntu:18.04
2020-03-06T11:17:32.654+0100 FATAL error in image scan: failed analysis: analyze error: failed to analyze layer: sha256:b6b53be908de2c0c78070fff0a9f04835211b3156c4e73785747af365e71a0d7 : failed to get packages: failed to get packages: no rpm command

[knqyf263]

@bgoareguer Thank you for the detail. Let me check.

[marefr]

Thanks for looking into this.

In CircleCI we use circleci/buildpack-deps:stretch docker image:

 scan-docker-master:
    docker:
      - image: circleci/buildpack-deps:stretch
    steps:
      - setup_remote_docker
      - restore_cache:
          key: vulnerability-db
      - run:
          name: Install trivy
          command: |
            VERSION=$(
                curl --silent "https://api.github.com/repos/aquasecurity/trivy/releases/latest" | \
                grep '"tag_name":' | \
                sed -E 's/.*"v([^"]+)".*/\1/'
            )

            wget https://github.com/aquasecurity/trivy/releases/download/v${VERSION}/trivy_${VERSION}_Linux-64bit.tar.gz
            tar zxvf trivy_${VERSION}_Linux-64bit.tar.gz
            sudo mv trivy /usr/local/bin
      - run:
          name: Clear trivy cache
          command: trivy --clear-cache
      - run:
          name: Scan the latest grafana master alpine image with trivy
          command: trivy --exit-code 1 grafana/grafana:master
      - run:
          name: Scan the latest grafana master ubuntu image with trivy
          command: trivy --exit-code 1 grafana/grafana:master-ubuntu
      - save_cache:
          key: vulnerability-db
          paths:
            - $HOME/.cache/trivy

Some more information in https://github.com/grafana/grafana/issues/22615

[knqyf263]

@marefr I'm sorry I found a cause and fixed it. I'll release a new version. Just a moment.

[knqyf263]

I've released v0.5.2. Would you try it? I apologize for the inconvenience.
https://github.com/aquasecurity/trivy/releases/tag/v0.5.2

[webmutation]

I am running it against mostly openjdk:8-jre-alpine builds.
I will take a look if the new version solves it. thanks for the quick reply!

UPDATE: working again with 0.5.2. Thanks

[bgoareguer]

Ok, it works with v0.5.2. Thanks for the quick fix!

$ ./trivy ubuntu:18.04
2020-03-06T14:56:22.535+0100 INFO Need to update DB
2020-03-06T14:56:22.535+0100 INFO Downloading DB...
15.07 MiB / 15.07 MiB [---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------] 100.00% 8.97 MiB p/s 2s
2020-03-06T14:56:25.233+0100 INFO Reopening DB...
2020-03-06T14:56:28.514+0100 INFO Detecting Ubuntu vulnerabilities...

ubuntu:18.04 (ubuntu 18.04)

Total: 62 (UNKNOWN: 0, LOW: 10, MEDIUM: 35, HIGH: 17, CRITICAL: 0)

[marefr]

Confirmed working. Thanks a lot for the quick response/fix.

[knqyf263]

Thank you all for reporting the issue and the quick confirmation!