Trivy: Offline DB

Created on 6 May 2020  路  18Comments  路  Source: aquasecurity/trivy


Is there a way to download the DB beforehand into a file and pass it as argument when running?

kinfeature triagsupport
Source
picture bendanye
👍3 ❤1 🎉1

Most helpful comment

Working with this in an air-gapped environment is problematic. Is there a way of initializing trivy with a downloaded copy of the db?

picture drewboswell on 12 May 2020
👍4

All 18 comments

What about the solution from https://github.com/aquasecurity/trivy/issues/423 ?

mozillazg picture mozillazg on 6 May 2020

I follow the solution but each time i run it with --skip-update will have error saying "The first run cannot skip downloading DB".

bendanye picture bendanye on 7 May 2020
👍4

Working with this in an air-gapped environment is problematic. Is there a way of initializing trivy with a downloaded copy of the db?

drewboswell picture drewboswell on 12 May 2020
👍4

Artifactory or Nexus 3 (my case) support would be very welcome here...

dmpe picture dmpe on 27 May 2020
👍1

Offline DBs are now available. You can find them under Trivy DB releases here https://github.com/aquasecurity/trivy-db/releases

image

Please give it a try and let us know if it helps.

simar7 picture simar7 on 5 Jun 2020
👍2 ❤1

Working with this in an air-gapped environment is problematic. Is there a way of initializing trivy with a downloaded copy of the db?

How do you deal with this problem

armandxu picture armandxu on 8 Jun 2020

@simar7 thank you - it is very much welcome. But I would also appriciate if there would be some description/docs on how to use it with client/server mode...

Do I just say trivy server --listen 0.0.0.0:8080 --cashe-dir location-to-extracted-db ?

I am asking this because being in air-gapped environment is what I currently have to work with. There is no connection possible to the github,etc. Thanks again!

dmpe picture dmpe on 23 Jun 2020

https://github.com/aquasecurity/trivy#air-gapped-environment thank you @knqyf263 !

dmpe picture dmpe on 25 Jun 2020

I'm so sorry, but it doesn't work in air-gapped environments in the case of scanning an alpine image. I will fix it as soon as possible. Just a moment, please.
https://github.com/aquasecurity/trivy/issues/546

knqyf263 picture knqyf263 on 26 Jun 2020
👍1

I'm so sorry, but it doesn't work in air-gapped environments in the case of scanning an alpine image. I will fix it as soon as possible. Just a moment, please.

546

Can the trivy server be run in an air-gap? when running
trivy server --skip-update -listen 0.0.0.0:8080
the error "The first run cannot skip downloading DB" is still received on trivy 0.9.1

Gerry9000 picture Gerry9000 on 16 Jul 2020
👍1

Has anyone been able to get the initial run for air-gap to work with the cache DB? I keep getting the error that first run needs to download the DB:

trivy image --skip-update k8s.gcr.io/pause:3.1

2020-08-26T15:16:01.996-0700 ERROR The first run cannot skip downloading DB
2020-08-26T15:16:01.997-0700 FATAL database error: --skip-update cannot be specified on the first run

rjew24 picture rjew24 on 27 Aug 2020

Has anyone been able to get the initial run for air-gap to work with the cache DB? I keep getting the error that first run needs to download the DB:

trivy image --skip-update k8s.gcr.io/pause:3.1

2020-08-26T15:16:01.996-0700 ERROR The first run cannot skip downloading DB
2020-08-26T15:16:01.997-0700 FATAL database error: --skip-update cannot be specified on the first run

The first time you run you need to have a current trivy-db or modify the metadata.json to be current and don't use --skip-update - after that use --skip-update.

Gerry9000 picture Gerry9000 on 27 Aug 2020

I went to https://github.com/aquasecurity/trivy-db/releases to download the latest trivy-offline.db.tgz and unpacked it to the default cache dir: /root/.cache/trivy and it contains the trivy.db and metadata.json files. If I try to run with the --skip-update switch, then I get the error:

2020-08-26T15:54:52.331-0700 INFO Need to update DB
2020-08-26T15:54:52.331-0700 INFO Downloading DB...
2020-08-26T15:55:22.331-0700 FATAL failed to download vulnerability DB: failed to download vulnerability DB: failed to list releases: Get https://api.github.com/repos/aquasecurity/trivy-db/releases: dial tcp 192.30.255.117:443: i/o timeout

rjew24 picture rjew24 on 27 Aug 2020

@rjew24 You should put the DB file into the cache directory + /db (for example: /root/.cache/trivy/db/trivy.db and /root/.cache/trivy/db/metadata.json ), read more: https://github.com/aquasecurity/trivy/blob/master/docs/air-gap.md#put-the-db-file-in-trivys-cache-directory

mozillazg picture mozillazg on 30 Aug 2020

@mozillazg
Expected Behavior

trivy server use offline db,
trivy client request vulnerability info from trivy server.
do not hot update, just use offline-db.

Current Behavior

server run command
trivy server -d --skip-update --listen "0.0.0.0:4954" --token $(TOKEN)

server logs

2020-12-09T02:52:27.531Z    DEBUG   cache dir:  /root/.cache/trivy
2020-12-09T02:52:27.535Z    DEBUG   DB Schema: 1, Type: 1, UpdatedAt: 2020-03-20 12:06:43.094662931 +0000 UTC, NextUpdate: 2020-03-21 00:06:43.094662531 +0000 UTC
2020-12-09T02:52:27.536Z    INFO    Listening 0.0.0.0:4954...
2020-12-09T03:52:27.542Z    INFO    Updating DB...
2020-12-09T03:52:57.547Z    ERROR   failed DB hot update:
    github.com/aquasecurity/trivy/pkg/rpc/server.dbWorker.update
        /home/circleci/project/pkg/rpc/server/listen.go:111

2020-12-09T04:52:57.547Z    INFO    Updating DB...
2020-12-09T04:53:27.548Z    ERROR   failed DB hot update:
    github.com/aquasecurity/trivy/pkg/rpc/server.dbWorker.update
        /home/circleci/project/pkg/rpc/server/listen.go:111

Possible Solution
--skip-update not works for hot-update. db update every hour.

Steps to Reproduce (for bugs)

  1. running trivy server
  2. start a trivy client
  3. go trivy server log

Context
Your Environment
Version used: 0.5.2

hex-py picture hex-py on 10 Dec 2020

@hex-py Looks like the latest version of trivy worked as expected:

$ ./trivy server -d --skip-update --listen "0.0.0.0:4954" 
2020-12-13T22:28:34.499+0800    DEBUG   cache dir:  /Users/xxx/Library/Caches/trivy
2020-12-13T22:28:34.540+0800    DEBUG   DB Schema: 1, Type: 1, UpdatedAt: 2020-11-11 12:14:06.187514597 +0000 UTC, NextUpdate: 2020-11-12 00:14:06.187513897 +0000 UTC, DownloadedAt: 2020-11-11 15:13:56.408619 +0000 UTC
2020-12-13T22:28:34.540+0800    INFO    Listening 0.0.0.0:4954...
2020-12-13T22:29:10.483+0800    INFO    Detecting Alpine vulnerabilities...
2020-12-13T22:29:10.483+0800    DEBUG   alpine: os version: 3.11
2020-12-13T22:29:10.483+0800    DEBUG   alpine: the number of packages: 14
2020-12-13T22:29:10.485+0800    INFO    Trivy skips scanning programming language libraries because no supported file was detected

$ ./trivy client alpine:3.11

alpine:3.11 (alpine 3.11.6)
===========================
Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

$ ./trivy --version
Version: v0.14.0-5-g1371f72
Vulnerability DB:
  Type: Light
  Version: 1
  UpdatedAt: 2020-11-11 12:14:06.187514597 +0000 UTC
  NextUpdate: 2020-11-12 00:14:06.187513897 +0000 UTC
  DownloadedAt: 2020-11-11 15:13:56.408619 +0000 UTC
mozillazg picture mozillazg on 13 Dec 2020

@mozillazg Thx for your reply. you'll have to wait a lot longer. trivy-updates can be skipped when the trivy-server is started, but server can't skip the hot updates every hour after that.you can see it in my server-log(Pay attention to timestamps).

```
trivy-version
Version 0.14.0
````

hex-py picture hex-py on 21 Dec 2020

@hex-py Looks like the latest version of trivy worked as expected:

$ ./trivy server -d --skip-update --listen "0.0.0.0:4954" 
2020-12-13T22:28:34.499+0800    DEBUG   cache dir:  /Users/xxx/Library/Caches/trivy
2020-12-13T22:28:34.540+0800    DEBUG   DB Schema: 1, Type: 1, UpdatedAt: 2020-11-11 12:14:06.187514597 +0000 UTC, NextUpdate: 2020-11-12 00:14:06.187513897 +0000 UTC, DownloadedAt: 2020-11-11 15:13:56.408619 +0000 UTC
2020-12-13T22:28:34.540+0800    INFO    Listening 0.0.0.0:4954...
2020-12-13T22:29:10.483+0800    INFO    Detecting Alpine vulnerabilities...
2020-12-13T22:29:10.483+0800    DEBUG   alpine: os version: 3.11
2020-12-13T22:29:10.483+0800    DEBUG   alpine: the number of packages: 14
2020-12-13T22:29:10.485+0800    INFO    Trivy skips scanning programming language libraries because no supported file was detected

$ ./trivy client alpine:3.11

alpine:3.11 (alpine 3.11.6)
===========================
Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

$ ./trivy --version
Version: v0.14.0-5-g1371f72
Vulnerability DB:
  Type: Light
  Version: 1
  UpdatedAt: 2020-11-11 12:14:06.187514597 +0000 UTC
  NextUpdate: 2020-11-12 00:14:06.187513897 +0000 UTC
  DownloadedAt: 2020-11-11 15:13:56.408619 +0000 UTC

@mozillazg
ListenAndServe starts Trivy server update interval 1 hour. but funcNeedsUpdate use hardcode false at params skip.

trivy-server update interval 1 hour:
https://github.com/aquasecurity/trivy/blob/e2c483f856c6512e8dcb713394842cbfd42c20f5/pkg/rpc/server/listen.go#L42

NeedsUpdate second argument skip is hard-coded:
https://github.com/aquasecurity/trivy/blob/e2c483f856c6512e8dcb713394842cbfd42c20f5/pkg/rpc/server/listen.go#L116

hex-py picture hex-py on 6 Jan 2021
Was this page helpful?
0 / 5 - 0 ratings

Related issues

abedra picture abedra  路  4Comments
06kellyjac picture 06kellyjac  路  5Comments
nunofernandes picture nunofernandes  路  4Comments
ahmddp picture ahmddp  路  4Comments
urbaniak picture urbaniak  路  5Comments