Trivy 0.58.1 can't download vulnerability DB

[LiZhang19817]

Description

trivy --version
Version: 0.58.1

Desired Behavior

Should be able to scan my image

Actual Behavior

trivy image python:3.4-alpine --debug
2025-01-10T11:55:07+08:00 DEBUG No plugins loaded
2025-01-10T11:55:07+08:00 DEBUG Default config file "file_path=trivy.yaml" not found, using built in values
2025-01-10T11:55:07+08:00 DEBUG Cache dir dir="/Users/lizhang/Library/Caches/trivy"
2025-01-10T11:55:07+08:00 DEBUG Cache dir dir="/Users/lizhang/Library/Caches/trivy"
2025-01-10T11:55:07+08:00 DEBUG Parsed severities severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2025-01-10T11:55:07+08:00 DEBUG Ignore statuses statuses=[]
2025-01-10T11:55:07+08:00 DEBUG [vulndb] There is no valid metadata file err="unable to open a file: open /Users/lizhang/Library/Caches/trivy/db/metadata.json: no such file or directory"
2025-01-10T11:55:07+08:00 INFO [vulndb] Need to update DB
2025-01-10T11:55:07+08:00 DEBUG [vulndb] No metadata file
2025-01-10T11:55:07+08:00 INFO [vulndb] Downloading vulnerability DB...
2025-01-10T11:55:07+08:00 INFO [vulndb] Downloading artifact... repo="mirror.gcr.io/aquasec/trivy-db:2"
2025-01-10T11:55:07+08:00 FATAL Fatal error

• init error:
  github.com/aquasecurity/trivy/pkg/commands/artifact.Run
  github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:367
• DB error:
  github.com/aquasecurity/trivy/pkg/commands/artifact.NewRunner
  github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:119
• failed to download vulnerability DB:
  github.com/aquasecurity/trivy/pkg/commands/operation.DownloadDB
  github.com/aquasecurity/trivy/pkg/commands/operation/operation.go:40
• OCI artifact error:
  github.com/aquasecurity/trivy/pkg/db.(*Client).Download
  github.com/aquasecurity/trivy/pkg/db/db.go:163
• failed to download vulnerability DB:
  github.com/aquasecurity/trivy/pkg/db.(*Client).downloadDB
  github.com/aquasecurity/trivy/pkg/db/db.go:212
• failed to download artifact from mirror.gcr.io/aquasec/trivy-db:2:
  github.com/aquasecurity/trivy/pkg/oci.Artifacts.Download
  github.com/aquasecurity/trivy/pkg/oci/artifact.go:238
• OCI repository error:
  github.com/aquasecurity/trivy/pkg/oci.(*Artifact).populate
  github.com/aquasecurity/trivy/pkg/oci/artifact.go:97
• 1 error occurred:
  • error getting credentials - err: signal: killed, out: ``

Reproduction Steps

1.
2.
3.
...

Target

None

Scanner

None

Output Format

None

Mode

None

Debug Output

See above

Operating System

MacOS 15.2 M1

Version

trivy --version
Version: 0.58.1

Checklist

• Run trivy clean --all
• Read the troubleshooting

[LiZhang19817]

Also tried run trivy clean, still not work.

trivy clean --all
2025-01-10T12:04:50+08:00	INFO	Removing scan cache...
2025-01-10T12:04:50+08:00	INFO	Removing vulnerability database...
2025-01-10T12:04:50+08:00	INFO	Removing Java database...
2025-01-10T12:04:50+08:00	INFO	Removing check bundle...
2025-01-10T12:04:50+08:00	INFO	Removing VEX repositories...

[DmitriyLewen]

Hello @LiZhang19817

Looks like i found similar problem - https://forums.docker.com/t/docker-login-fails-with-error-saving-credentials-error-storing-credentials-err-signal-killed-out/136277

Have you logged into Docker for mirror.gcr.io? Or maybe you're using env with credentials.
Are you getting this error for another repository? You can check with --db-repository ghcr.io/aquasecurity/trivy-db:2.

[LiZhang19817]

@DmitriyLewen Yes, change with other db repository, still git the same issue.

podman login mirror.gcr.io
Authenticating with existing credentials for mirror.gcr.io
Existing credentials are valid. Already logged in to mirror.gcr.io

trivy image python:3.4-alpine --db-repository ghcr.io/aquasecurity/trivy-db:2                                                           
2025-01-10T13:21:36+08:00	INFO	[vulndb] Need to update DB
2025-01-10T13:21:36+08:00	INFO	[vulndb] Downloading vulnerability DB...
2025-01-10T13:21:36+08:00	INFO	[vulndb] Downloading artifact...	repo="ghcr.io/aquasecurity/trivy-db:2"
2025-01-10T13:21:36+08:00	FATAL	Fatal error	init error: DB error: failed to download vulnerability DB: OCI artifact error: failed to download vulnerability DB: failed to download artifact from ghcr.io/aquasecurity/trivy-db:2: OCI repository error: 1 error occurred:
	* error getting credentials - err: signal: killed, out: ``

[DmitriyLewen]

hm... perhaps Trivy (or go-containerregistry) can't correctly get credentials from auth.json.
Can you logout for mirror.gcr.io and try with this repositroy?

[aivarannamaa]

I met the same problem with Brew-installed trivy 0.55.0_1, which used to work. Upgraded to 0.58.2, but still no success. I'm not using Docker.

Are you getting this error for another repository? You can check with --db-repository ghcr.io/aquasecurity/trivy-db:2

I get the same error with this repository.

Tried deleting ~/Library/Caches/trivy, but this does not help.

Can you logout for mirror.gcr.io and try with this repositroy?

How do I do this?

[DmitriyLewen]

I'm not using Docker.

maybe you are using podman?

[aivarannamaa]

It turns out I misunderstood Trivy. I did have Docker installed, but I did not realise trivy is using it for its own work. I updated my Docker installation and Trivy started to work again.