From fc965e072c4c3fbcefc517ff34375fd97f0f83e1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Joachim=20Schl=C3=B6ffel?= Date: Tue, 29 Sep 2026 09:17:53 +0200 Subject: [PATCH] fix trivy db download n CI --- scripts/apk/security-report.sh | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/scripts/apk/security-report.sh b/scripts/apk/security-report.sh index 9a14442..6cdc8ec 100755 --- a/scripts/apk/security-report.sh +++ b/scripts/apk/security-report.sh @@ -10,6 +10,11 @@ alpine_version="${ALPINE_VERSION:-3.24}" arches="${ALPINE_SECURITY_ARCHES:-${ALPINE_ARCHES:-x86_64}}" reports_dir="${APK_SECURITY_REPORTS_DIR:-${repo_root}/packages/security-reports}" trivy_bin="${TRIVY_BIN:-trivy}" +# The GCR pull-through mirror can serve a manifest whose layer has already +# expired, returning 404 rather than letting Trivy continue to its fallback. +# Use the publisher's registry directly; callers may still select an internal +# mirror by setting TRIVY_DB_REPOSITORY. +trivy_db_repository="${TRIVY_DB_REPOSITORY:-ghcr.io/aquasecurity/trivy-db:2}" require_command() { command -v "$1" >/dev/null 2>&1 || { @@ -166,9 +171,9 @@ while IFS= read -r package_dir; do install_rootfs_docker "${rootfs}" "${arch}" "${specs[@]}" fi - "${trivy_bin}" filesystem --distro "alpine/${alpine_version}" --scanners vuln --format json --no-progress \ + "${trivy_bin}" filesystem --db-repository "${trivy_db_repository}" --distro "alpine/${alpine_version}" --scanners vuln --format json --no-progress \ --output "${report_dir}/trivy.json" "${rootfs}/installed" - "${trivy_bin}" filesystem --distro "alpine/${alpine_version}" --scanners vuln --format cyclonedx --no-progress \ + "${trivy_bin}" filesystem --db-repository "${trivy_db_repository}" --distro "alpine/${alpine_version}" --scanners vuln --format cyclonedx --no-progress \ --output "${report_dir}/sbom.cdx.json" "${rootfs}/installed" jq -e 'type == "object" and has("ArtifactName")' "${report_dir}/trivy.json" >/dev/null jq -e '.bomFormat == "CycloneDX"' "${report_dir}/sbom.cdx.json" >/dev/null