Unable to install Grype

[nblack-er]

What happened:

Starting a few hours ago, it was noticed that installation of Grype is no longer working with the install.sh script.

What you expected to happen:

No errors

How to reproduce it (as minimally and precisely as possible):

curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin [info] checking github for the current release tag [error] unable to find tag='' [error] do not specify a version or select a valid version from https://github.com/anchore/grype/releases

Anything else we need to know?:

Environment:

• Output of grype version:
• OS (e.g: cat /etc/os-release or similar): 22.04.1 LTS (Jammy Jellyfish)

[nblack-er]

https://github.com/orgs/community/discussions/45590

[kzantow]

Hi @nblack-er I've just tried this out for macOS and Linux and it seems to be working fine for me, could you retry?

NOTE I also saw a failure yesterday where https://github.com/anchore/grype/releases/download/v0.56.0/grype_0.56.0_linux_arm64.deb was returning 403 for some reason, but seems to be fine now.

[kzantow]

As @jdolitsky noted, it might be good to add a fallback to the API call here: https://api.github.com/repos/{org}/{repo}/releases/latest

[cw-alexcroteau]

Cross-posted from the analogous issue in the Syft repo:

I would agree with the benefits of a fallback, as long as it doesn't become the only option.

Sadly, the API requires a GitHub token even for public repositories. The default GitHub token provided in GitHub Actions doesn't work for this purpose, so repositories might have to use a PAT/application token. This might not be feasible for public repositories and would pose a security risk for something that should be public.

[nblack-er]

GitHub reverted the change, and I am able to use the install.sh script again.

[ericodonoghue]

I am still running into this issue. Just copying the command from the installation section. Ubuntu 22.04.2 LTS (Jammy Jellyfish)

[tgerla]

Hi @ericodonoghue, I just tried to reproduce and I can't get it to fail here on my end, on a couple of different systems. I wonder if it was a temporary outage on the github side? Can you try again and see if the error repeats?

[wagoodman]

If you're still running into this issue can you post the output of:

curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin -dd

(note the -dd)

[ericodonoghue]

It worked, must of been an issue with Github. Thanks!

[nemonik]

I'm getting the same thing in a ubuntu:jammy container.

#9 [6/6] RUN curl -ksSL  https://raw.githubusercontent.com/anchore/grype/main/install.sh -o /tmp/grype_install.sh   && chmod +x /tmp/grype_install.sh   && /tmp/grype_install.sh -b /usr/local/bin
#9 0.630 [info] checking github for the current release tag
#9 1.000 [error] received HTTP status=000 for url='https://github.com/anchore/grype/releases/latest'
#9 1.009 [error] unable to find tag=''
#9 1.011 [error] do not specify a version or select a valid version from https://github.com/anchore/grype/releases
#9 DONE 1.0s

Using -dd returns

#9 [6/6] RUN curl -ksSL  https://raw.githubusercontent.com/anchore/grype/main/install.sh -o /tmp/grype_install.sh   && chmod +x /tmp/grype_install.sh   && /tmp/grype_install.sh -b /usr/local/bin -dd
#9 0.610 [info] checking github for the current release tag
#9 0.618 [trace] get_release_tag(owner=anchore, repo=grype, tag=)
#9 0.625 [debug] http_download(url=https://github.com/anchore/grype/releases/latest)
#9 0.630 [trace] http_download_curl(local_file=/tmp/tmp.NrGSJnlBcI, source_url=https://github.com/anchore/grype/releases/latest, header=Accept:application/json)
#9 1.021 [error] received HTTP status=000 for url='https://github.com/anchore/grype/releases/latest'
#9 1.032 [trace] github_release_json(owner=anchore, repo=grype, version=latest) returned ''
#9 1.046 [error] unable to find tag=''
#9 1.050 [error] do not specify a version or select a valid version from https://github.com/anchore/grype/releases
#9 DONE 1.1s

the tag seems empty.

Passing latest as the tag via

RUN curl -ksSL  https://raw.githubusercontent.com/anchore/grype/main/install.sh -o /tmp/grype_install.sh \
  && chmod +x /tmp/grype_install.sh \
  && /tmp/grype_install.sh -b /usr/local/bin -dd latest

Does the same thing.

[nemonik]

I can install if I do something rather lazy as

RUN curl -ksSL https://github.com/anchore/grype/releases/download/v0.74.6/grype_0.74.6_$(uname | tr '[:upper:]' '[:lower:]')_$(dpkg --print-architecture).deb -o /tmp/grype.deb \
  && dpkg -i /tmp/grype.deb