Java DB download reports failure despite appearing to download

[internetstaff]

Description

Java DB download reports a failure after appearing to download successfully. Running a scan after this failure seems to use the java db.

$ trivy image --download-java-db-only 
2024-10-03T07:18:03-07:00	INFO	[javadb] Downloading Java DB...
2024-10-03T07:18:03-07:00	INFO	[javadb] Downloading artifact...	repo="ghcr.io/aquasecurity/trivy-java-db:1"
649.13 MiB / 649.13 MiB [-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------] 100.00% 4.82 MiB p/s 2m15s
2024-10-03T07:20:19-07:00	INFO	[javadb] Artifact successfully downloaded	repo="ghcr.io/aquasecurity/trivy-java-db:1"
2024-10-03T07:20:19-07:00	FATAL	Fatal error	init error: DB error: Java DB error: OCI artifact error: failed to download Java DB from any source

Desired Behavior

No fatal error. :)

Actual Behavior

Fatal error.

Reproduction Steps

1. trivy image --download-java-db-only

Target

Container Image

Scanner

Vulnerability

Output Format

None

Mode

None

Debug Output

$ trivy image --download-java-db-only --debug
2024-10-03T07:27:50-07:00	DEBUG	No plugins loaded
2024-10-03T07:27:50-07:00	DEBUG	Default config file "file_path=trivy.yaml" not found, using built in values
2024-10-03T07:27:50-07:00	DEBUG	Cache dir	dir="/home/cott/.cache/trivy"
2024-10-03T07:27:50-07:00	DEBUG	Cache dir	dir="/home/cott/.cache/trivy"
2024-10-03T07:27:50-07:00	DEBUG	Parsed severities	severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2024-10-03T07:27:50-07:00	DEBUG	Ignore statuses	statuses=[]
2024-10-03T07:27:50-07:00	INFO	[javadb] Downloading Java DB...
2024-10-03T07:27:50-07:00	INFO	[javadb] Downloading artifact...	repo="ghcr.io/aquasecurity/trivy-java-db:1"
649.13 MiB / 649.13 MiB [-------------------------------------------------------------------------------------------------------------------------------------------------------------] 100.00% 3.90 MiB p/s 2m46s
2024-10-03T07:30:37-07:00	INFO	[javadb] Artifact successfully downloaded	repo="ghcr.io/aquasecurity/trivy-java-db:1"
2024-10-03T07:30:37-07:00	FATAL	Fatal error
  - init error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.Run
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:367
  - DB error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.NewRunner
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:119
  - Java DB error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).initJavaDB
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:328
  - OCI artifact error:
    github.com/aquasecurity/trivy/pkg/javadb.(*Updater).Update
        /home/runner/work/trivy/trivy/pkg/javadb/client.go:63
  - failed to download Java DB from any source:
    github.com/aquasecurity/trivy/pkg/javadb.(*Updater).downloadDB
        /home/runner/work/trivy/trivy/pkg/javadb/client.go:110

Operating System

Fedora, Amazon Linux

Version

Version: 0.56.0
Java DB:
  Version: 1
  UpdatedAt: 2024-10-03 02:32:34.633277595 +0000 UTC
  NextUpdate: 2024-10-06 02:32:34.633277484 +0000 UTC
  DownloadedAt: 0001-01-01 00:00:00 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[nikpivkin]

Hi @internetstaff !

A patch with a fix will be released soon #7646

[knqyf263]

Released
https://github.com/aquasecurity/trivy/releases/tag/v0.56.1