BLOB_UNKNOWN: Unknown blob when pulling mirror.gcr.io/aquasec/trivy-db:2

[julien-michaud]

Description

Im getting the error below when trying to scan a filesystem from a github runner.
I have to restart the job a few times for it to finish successfully.

2024-11-28T13:03:46Z	WARN	'--vuln-type' is deprecated. Use '--pkg-types' instead.
2024-11-28T13:03:46Z	INFO	[vulndb] Need to update DB
2024-11-28T13:03:46Z	INFO	[vulndb] Downloading vulnerability DB...
2024-11-28T13:03:46Z	INFO	[vulndb] Downloading artifact...	repo="mirror.gcr.io/aquasec/trivy-db:2"
2024-11-28T13:03:47Z	FATAL	Fatal error	init error: DB error: failed to download vulnerability DB: OCI artifact error: failed to download vulnerability DB: failed to download artifact from mirror.gcr.io/aquasec/trivy-db:2: oci download error: failed to fetch the layer: GET https://mirror.gcr.io/v2/aquasec/trivy-db/blobs/sha256:25525654f3a8e8a3f43a77d782fb84d6285cff9cb5f214c155c06ed65b890298: BLOB_UNKNOWN: Unknown blob: sha256:25525654f3a8e8a3f43a77d782fb84d6285cff9cb5f214c155c06ed65b890298

Desired Behavior

no error

Actual Behavior

trivy error

Reproduction Steps

1. Start trivy and use the trivy-db from gcr

Target

Filesystem

Scanner

Vulnerability

Output Format

SARIF

Mode

Standalone

Debug Output

2024-11-28T13:03:46Z	WARN	'--vuln-type' is deprecated. Use '--pkg-types' instead.
2024-11-28T13:03:46Z	INFO	[vulndb] Need to update DB
2024-11-28T13:03:46Z	INFO	[vulndb] Downloading vulnerability DB...
2024-11-28T13:03:46Z	INFO	[vulndb] Downloading artifact...	repo="mirror.gcr.io/aquasec/trivy-db:2"
2024-11-28T13:03:47Z	FATAL	Fatal error	init error: DB error: failed to download vulnerability DB: OCI artifact error: failed to download vulnerability DB: failed to download artifact from mirror.gcr.io/aquasec/trivy-db:2: oci download error: failed to fetch the layer: GET https://mirror.gcr.io/v2/aquasec/trivy-db/blobs/sha256:25525654f3a8e8a3f43a77d782fb84d6285cff9cb5f214c155c06ed65b890298: BLOB_UNKNOWN: Unknown blob: sha256:25525654f3a8e8a3f43a77d782fb84d6285cff9cb5f214c155c06ed65b890298

### Operating System

ubuntu 22.04

### Version

```bash
0.57.1

Checklist

• Run trivy clean --all
• Read the troubleshooting

[simar7]

hi @julien-michaud thanks for the report, we are aware of this issue. Would you know how often this happens as it seems to be related to the availability of mirror.gcr.io upstream but seems to be intermittent.

[julien-michaud]

Out of 100 runs, maybe 5, it's really rare

[tamalsaha]

We are also experiencing this issue. I remember the db used to be available in ghcr.io/aquasecurity/trivy-db:2 . Is there a way to pass a flag to download from ghcr.io instead of gcr.io ?

[iSenne]

Looks like it:

$ trivy image --db-repository registry.gitlab.com/gitlab-org/security-products/dependencies/trivy-db

https://trivy.dev/v0.57/docs/configuration/db/#db-repository

[knqyf263]

Duplicate of #8020