failed to download vulnerability DB: BLOB_UNKNOWN

[bo0ts]

Description

Failure to download vulnerability DB when run locally. Installed with homebrew on MacOS Sonoma.

Desired Behavior

Start the scan.

Actual Behavior

$ trivy fs .
2024-11-29T13:42:09+01:00	INFO	[vulndb] Need to update DB
2024-11-29T13:42:09+01:00	INFO	[vulndb] Downloading vulnerability DB...
2024-11-29T13:42:09+01:00	INFO	[vulndb] Downloading artifact...	repo="mirror.gcr.io/aquasec/trivy-db:2"
2024-11-29T13:42:09+01:00	FATAL	Fatal error	init error: DB error: failed to download vulnerability DB: OCI artifact error: failed to download vulnerability DB: failed to download artifact from mirror.gcr.io/aquasec/trivy-db:2: oci download error: failed to fetch the layer: GET https://mirror.gcr.io/v2/aquasec/trivy-db/blobs/sha256:a1973cb67b074515965a420875b7d20862ff19d5250ee4dcfe5081eedc7ea810: BLOB_UNKNOWN: Unknown blob: sha256:a1973cb67b074515965a420875b7d20862ff19d5250ee4dcfe5081eedc7ea810

Reproduction Steps

1. Run any trivy command

Target

None

Scanner

None

Output Format

None

Mode

None

Debug Output

trivy fs --debug .
2024-11-29T13:45:09+01:00	DEBUG	No plugins loaded
2024-11-29T13:45:09+01:00	DEBUG	Default config file "file_path=trivy.yaml" not found, using built in values
2024-11-29T13:45:09+01:00	DEBUG	Cache dir	dir="/Users/heresiarch/Library/Caches/trivy"
2024-11-29T13:45:09+01:00	DEBUG	Cache dir	dir="/Users/heresiarch/Library/Caches/trivy"
2024-11-29T13:45:09+01:00	DEBUG	Parsed severities	severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2024-11-29T13:45:09+01:00	DEBUG	Ignore statuses	statuses=[]
2024-11-29T13:45:09+01:00	DEBUG	[vulndb] There is no valid metadata file	err="unable to open a file: open /Users/heresiarch/Library/Caches/trivy/db/metadata.json: no such file or directory"
2024-11-29T13:45:09+01:00	INFO	[vulndb] Need to update DB
2024-11-29T13:45:09+01:00	DEBUG	[vulndb] No metadata file
2024-11-29T13:45:09+01:00	INFO	[vulndb] Downloading vulnerability DB...
2024-11-29T13:45:09+01:00	INFO	[vulndb] Downloading artifact...	repo="mirror.gcr.io/aquasec/trivy-db:2"
2024-11-29T13:45:09+01:00	FATAL	Fatal error
  - init error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.Run
        github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:367
  - DB error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.NewRunner
        github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:119
  - failed to download vulnerability DB:
    github.com/aquasecurity/trivy/pkg/commands/operation.DownloadDB
        github.com/aquasecurity/trivy/pkg/commands/operation/operation.go:40
  - OCI artifact error:
    github.com/aquasecurity/trivy/pkg/db.(*Client).Download
        github.com/aquasecurity/trivy/pkg/db/db.go:163
  - failed to download vulnerability DB:
    github.com/aquasecurity/trivy/pkg/db.(*Client).downloadDB
        github.com/aquasecurity/trivy/pkg/db/db.go:212
  - failed to download artifact from mirror.gcr.io/aquasec/trivy-db:2:
    github.com/aquasecurity/trivy/pkg/oci.Artifacts.Download
        github.com/aquasecurity/trivy/pkg/oci/artifact.go:238
  - oci download error:
    github.com/aquasecurity/trivy/pkg/oci.(*Artifact).Download
        github.com/aquasecurity/trivy/pkg/oci/artifact.go:149
  - failed to fetch the layer:
    github.com/aquasecurity/trivy/pkg/oci.(*Artifact).download
        github.com/aquasecurity/trivy/pkg/oci/artifact.go:163
  - GET https://mirror.gcr.io/v2/aquasec/trivy-db/blobs/sha256:a1973cb67b074515965a420875b7d20862ff19d5250ee4dcfe5081eedc7ea810: BLOB_UNKNOWN: Unknown blob: sha256:a1973cb67b074515965a420875b7d20862ff19d5250ee4dcfe5081eedc7ea810

Operating System

macOS Sonoma

Version

$ trivy --version
Version: 0.57.1
Check Bundle:
  Digest: sha256:34fe41b4f92a89202ffe7f94c158884fe633a45751706735ebadce7a96ec7dec
  DownloadedAt: 2024-11-29 12:29:43.096523 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[simar7]

Does this happen often? We have seen issues with caching on mirror.gcr.io which have led to similar issues in the past.

[etaormm]

Happens often, maybe enable a fallback to 2nd repo if we get such errors?

[bo0ts]

This kept happening for at least 10 minutes and then I gave up. I just tried again and now it works.

[bhmdtv]

We get the same error-messages .... trivy-operator version 0.23.0.

[DmitriyLewen]

FYI we merged #8060.
Trivy handles BLOB_UNKNOWN error now aand moves on to the next repository.

[knqyf263]

Created #8069

[knqyf263]

https://github.com/aquasecurity/trivy/milestone/45

[c-seeger]

getting this constantly today:

$ trivy --version
Version: 0.58.0
$ trivy clean -a
20[24](https://gitlab.casee.de/final-rep/users-api/-/jobs/26390#L24)-12-16T13:28:56Z	INFO	Removing scan cache...
2024-12-16T13:28:56Z	INFO	Removing vulnerability database...
2024-12-16T13:28:56Z	INFO	Removing Java database...
2024-12-16T13:28:56Z	INFO	Removing check bundle...
2024-12-16T13:28:56Z	INFO	Removing VEX repositories...
$ trivy --cache-dir .trivycache/ image --download-db-only --no-progress
2024-12-16T13:28:56Z	INFO	[vulndb] Need to update DB
2024-12-16T13:28:56Z	INFO	[vulndb] Downloading vulnerability DB...
2024-12-16T13:28:56Z	INFO	[vulndb] Downloading artifact...	repo="mirror.gcr.io/aquasec/trivy-db:2"
2024-12-16T13:28:57Z	FATAL	Fatal error	init error: DB error: failed to download vulnerability DB: OCI artifact error: failed to download vulnerability DB: failed to download artifact from mirror.gcr.io/aquasec/trivy-db:2: oci download error: failed to fetch the layer: GET https://mirror.gcr.io/v2/aquasec/trivy-db/blobs/sha[25](https://gitlab.casee.de/final-rep/users-api/-/jobs/26390#L25)6:0e01986a9113923bb70aed0b0399ebf80d3d39edc3234ca71971b99a63c6d6bb: BLOB_UNKNOWN: Unknown blob: sha256:0e01986a9113923bb70aed0b0399ebf80d3d39edc3234ca71971b99a63c6d6bb

[DmitriyLewen]

We will add BLOB_UNKNOWN error handling in v0.58.1