filesystem scan error (eval_conflict_error: object keys must be unique)

[caiohasouza]

Description

On 0.29.x version i'm receiving an error on run "trivy config", on older versions all works fine.

What did you expect to happen?

The command trivy config /dockerfilefolder/ works fine.

What happened instead?

Error:

2022-06-23T13:01:04.072Z	FATAL	filesystem scan error: scan error: image scan failed: failed analysis: failed to call hooks: post handler error: scan config error: docker/lib/docker.rego:23: eval_conflict_error: object keys must be unique

Output of run with -debug:

2022-06-23T13:04:30.822Z	DEBUG	Severities: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
2022-06-23T13:04:30.828Z	DEBUG	cache dir:  /root/.cache/trivy
2022-06-23T13:04:30.828Z	INFO	Misconfiguration scanning is enabled
2022-06-23T13:04:31.029Z	FATAL	filesystem scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.run
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:359
  - scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:217
  - image scan failed:
    github.com/aquasecurity/trivy/pkg/commands/artifact.scan
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:515
  - failed analysis:
    github.com/aquasecurity/trivy/pkg/scanner.Scanner.ScanArtifact
        /home/runner/work/trivy/trivy/pkg/scanner/scan.go:112
  - failed to call hooks:
    github.com/aquasecurity/trivy/pkg/fanal/artifact/local.Artifact.Inspect
        /home/runner/work/trivy/trivy/pkg/fanal/artifact/local/fs.go:126
  - post handler error:
    github.com/aquasecurity/trivy/pkg/fanal/handler.Manager.PostHandle
        /home/runner/work/trivy/trivy/pkg/fanal/handler/handler.go:75
  - scan config error:
    github.com/aquasecurity/trivy/pkg/fanal/handler/misconf.misconfPostHandler.Handle
        /home/runner/work/trivy/trivy/pkg/fanal/handler/misconf/misconf.go:239
  - docker/lib/docker.rego:23: eval_conflict_error: object keys must be unique

Output of trivy -v:

version: 0.29.2

Additional details (base image name, container registry info...):

Dockerfile to simulate error:

FROM alpine:3.16

RUN mkdir /app/

# Configure files permissions
RUN set -ex && \
    find /app/ -type d -exec chmod 775 {} \;

### APP Image ###
FROM alpine:3.16

COPY --from=0 app/ /app/

[liamg]

Thanks, this is interesting, it looks like it's the usage of multiple FROM commands with the same image ref. I'll take a look later today 👍

[caiohasouza]

Hi @liamg

Perfect, thank you!

Regards

[cnwaldron]

I'm experiencing this issue with Trivy v0.34.0.

[simar7]

A simple example to repro:

FROM foo
CMD bar
FROM foo
ENTRYPOINT fff
ENTRYPOINT zzz

This also happens with multiple healthchecks as well. I've created aquasecurity/defsec#1327 to fix it.