scripts/apk/security-report.sh

@@ -10,6 +10,11 @@ alpine_version="${ALPINE_VERSION:-3.24}"
 arches="${ALPINE_SECURITY_ARCHES:-${ALPINE_ARCHES:-x86_64}}"
 reports_dir="${APK_SECURITY_REPORTS_DIR:-${repo_root}/packages/security-reports}"
 trivy_bin="${TRIVY_BIN:-trivy}"
+# The GCR pull-through mirror can serve a manifest whose layer has already
+# expired, returning 404 rather than letting Trivy continue to its fallback.
+# Use the publisher's registry directly; callers may still select an internal
+# mirror by setting TRIVY_DB_REPOSITORY.
+trivy_db_repository="${TRIVY_DB_REPOSITORY:-ghcr.io/aquasecurity/trivy-db:2}"
 
 require_command() {
   command -v "$1" >/dev/null 2>&1 || {
@@ -166,9 +171,9 @@ while IFS= read -r package_dir; do
       install_rootfs_docker "${rootfs}" "${arch}" "${specs[@]}"
     fi
 
-    "${trivy_bin}" filesystem --distro "alpine/${alpine_version}" --scanners vuln --format json --no-progress \
+    "${trivy_bin}" filesystem --db-repository "${trivy_db_repository}" --distro "alpine/${alpine_version}" --scanners vuln --format json --no-progress \
       --output "${report_dir}/trivy.json" "${rootfs}/installed"
-    "${trivy_bin}" filesystem --distro "alpine/${alpine_version}" --scanners vuln --format cyclonedx --no-progress \
+    "${trivy_bin}" filesystem --db-repository "${trivy_db_repository}" --distro "alpine/${alpine_version}" --scanners vuln --format cyclonedx --no-progress \
       --output "${report_dir}/sbom.cdx.json" "${rootfs}/installed"
     jq -e 'type == "object" and has("ArtifactName")' "${report_dir}/trivy.json" >/dev/null
     jq -e '.bomFormat == "CycloneDX"' "${report_dir}/sbom.cdx.json" >/dev/null