feat(db): append errors

[knqyf263]

Description

We should show the rate limit detail in the fatal error. Some users don't read log messages, and --quiet shows only a fatal log.

Before

$ trivy image debian:12 --quiet
2024-10-31T14:09:06+04:00       FATAL   Fatal error     init error: DB error: failed to download vulnerability DB: OCI artifact error: failed to download vulnerability DB: failed to download artifact from any source

After

$ trivy image debian:12 --quiet
2024-10-31T14:08:14+04:00       FATAL   Fatal error     init error: DB error: failed to download vulnerability DB: OCI artifact error: failed to download vulnerability DB: failed to download artifact from any source: 1 error occurred:
        * oci download error: failed to fetch the layer: GET https://ghcr.io/v2/aquasecurity/trivy-db/blobs/sha256:ba0d01953a8c28331552412292b72f3639b3962fe27f3359a51553a52d3f7b29: TOOMANYREQUESTS: retry-after: 947.147µs, allowed: 44000/minute

Related discussions

• Cannot download db for offline use since 0.56.2 #7841

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[nikpivkin]

BTW, errors can be joined together using the built-in function https://pkg.go.dev/errors@master#Join

[DmitriyLewen]

LGTM

[knqyf263]

BTW, errors can be joined together using the built-in function https://pkg.go.dev/errors@master#Join

Yes, I prefer stdlib, and tried it in several places. However, the formatted output is very unclear.
https://go.dev/play/p/AYls8a96t-j

Since this rate limit error is really important now, I'd go for go-multierror. We can probably add a new error package wrapping errors.Join to eliminate the go-multierror dependency, but i didn't have a chance to do that.

[knqyf263]

joinError is not exported. I have no idea how we can customize the output format.
https://github.com/golang/go/blob/6d39245514c675cdea5c7fd7f778e97bf0728dd5/src/errors/join.go#L40

We can define our joinError, but it's re-implementation of errors.Join.