public/alpine-packages
5
0
Fork 0
Code Issues Pull Requests Actions Packages Releases Activity

fix trivy db download n CI
Build Alpine Packages / preflight (pull_request) Successful in 15s
Details
Build Alpine Packages / build (gitea) (pull_request) Successful in 16s
Details
Build Alpine Packages / build (lavinmq) (pull_request) Successful in 2m57s
Details
Build Alpine Packages / build (seaweedfs) (pull_request) Successful in 20m41s
Details
Build Alpine Packages / build (greptimedb) (pull_request) Successful in 1h14m12s
Details
Build Alpine Packages / verify-and-publish (pull_request) Successful in 1m47s
Details

Browse Source
This commit is contained in:
Joachim Schlöffel
2026-09-29 09:33:26 +02:00
parent 1c3994a7c4
commit fc965e072c
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/apk/security-report.sh
+7 -2
View File
@@ -10,6 +10,11 @@ alpine_version="${ALPINE_VERSION:-3.24}"
arches="${ALPINE_SECURITY_ARCHES:-${ALPINE_ARCHES:-x86_64}}"
reports_dir="${APK_SECURITY_REPORTS_DIR:-${repo_root}/packages/security-reports}"
trivy_bin="${TRIVY_BIN:-trivy}"
# The GCR pull-through mirror can serve a manifest whose layer has already
# expired, returning 404 rather than letting Trivy continue to its fallback.
# Use the publisher's registry directly; callers may still select an internal
# mirror by setting TRIVY_DB_REPOSITORY.
trivy_db_repository="${TRIVY_DB_REPOSITORY:-ghcr.io/aquasecurity/trivy-db:2}"
require_command() {
command -v "$1" >/dev/null 2>&1 || {
@@ -166,9 +171,9 @@ while IFS= read -r package_dir; do
install_rootfs_docker "${rootfs}" "${arch}" "${specs[@]}"
fi
"${trivy_bin}" filesystem --distro "alpine/${alpine_version}" --scanners vuln --format json --no-progress \
"${trivy_bin}" filesystem --db-repository "${trivy_db_repository}" --distro "alpine/${alpine_version}" --scanners vuln --format json --no-progress \
--output "${report_dir}/trivy.json" "${rootfs}/installed"
"${trivy_bin}" filesystem --distro "alpine/${alpine_version}" --scanners vuln --format cyclonedx --no-progress \
"${trivy_bin}" filesystem --db-repository "${trivy_db_repository}" --distro "alpine/${alpine_version}" --scanners vuln --format cyclonedx --no-progress \
--output "${report_dir}/sbom.cdx.json" "${rootfs}/installed"
jq -e 'type == "object" and has("ArtifactName")' "${report_dir}/trivy.json" >/dev/null
jq -e '.bomFormat == "CycloneDX"' "${report_dir}/sbom.cdx.json" >/dev/null