How to get the security report to show up?

[stranljip]

Hi - until the recent update to 1.11.0 I had security reports for all charts in my ArtifactHUB instance. After the update some charts do not display this section anymore. I suspect that this is due to the fact that the scan does not finish successfully:

{"level":"error","cmd":"scanner","pkg":"5fe50d43-90e3-4259-9641-a67c0b0756d6","version":"1.1.2","error":"error scanning image registry.example.org/project/artifact:8.1: error running trivy on image registry.example.org/project/artifact:8.1: 2023-01-17T09:29:29.781Z\t\u001b[31mFATAL\u001b[0m\timage scan error: scan error: scan failed: failed analysis: analyze error: failed to analyze layer: : walk error: failed to process the file: failed to analyze file: failed to analyze <some-path>/<artifact>.jar: unable to open <some-path>/<artifact>.jar: failed to open: unable to read the file: unexpected EOF\n (package <foopackage>:1.1.2)","time":"2023-01-17T09:29:29Z"}

When I scan this image with trivy locally (0.36) the scan succeeds although I have to increase the timeout - I don't know if this might be the cause?

[tegioz]

Hi @stranljip 👋

Yes, if the image scanning doesn't complete successfully there won't be a security report available. It'd be great if you had a public repo/images where the problem could be reproduced (assuming this one is private 😉). But I'll share some thoughts just in case any of them help 😇

• AH 1.11 uses Trivy 0.34.0, so it could be interesting to test it locally with that version. In master we are on 0.35.0, with plans to switch to 0.36.1 soon. Please note that the scanner component includes the Trivy CLI to talk to the server, and we always use the same version in both in our tests and deployments. You could also build the AH images from master to see if the problem persists with 0.35.0.
• If you were only missing reports with no vulnerabilities found, this could be the reason.
• At the moment the Trivy client command we run uses a timeout of 15 minutes. You can also use this as a base to compare against the command you are running locally to test.

[stranljip]

It works like a charm locally :-/
But ... right now I am also seeing issues with trivy on our Harbor registry, so I suspect this is something else completely.

[stranljip]

Hah - that was too early. After deleting the cached database I get the same errors locally. You will see something like

2023-01-18T15:31:11.650+0100	DEBUG	Parsing Java artifacts...	{"file": "usr/local/tomcat/webapps/cadenza/WEB-INF/lib/ejml-ddense-0.39.jar"}
2023-01-18T15:31:42.503+0100	DEBUG	retrying request	{"request": "GET https://search.maven.org/solrsearch/select?q=g%3A%22org.apache%22+AND+a%3A%22javax.annotation%22&rows=1 (status: 502)", "timeout": "20s", "remaining": 5}
2023-01-18T15:32:08.787+0100	DEBUG	retrying request	{"request": "GET https://search.maven.org/solrsearch/select?q=1%3A%22f42c905b831667e7a6f6b4d0580d358dc511862b%22&rows=1&wt=json (status: 504)", "timeout": "20s", "remaining": 5}
2023-01-18T15:32:08.789+0100	DEBUG	retrying request	{"request": "GET https://search.maven.org/solrsearch/select?q=1%3A%22851e92c470486333f75f700b4af88bbe16c90fac%22&rows=1&wt=json (status: 504)", "timeout": "20s", "remaining": 5}
2023-01-18T15:32:08.864+0100	DEBUG	retrying request	{"request": "GET https://search.maven.org/solrsearch/select?q=1%3A%2283cd2cd674a217ade95a4bb83a8a14f351f48bd0%22&rows=1&wt=json (status: 504)", "timeout": "20s", "remaining": 5}
2023-01-18T15:32:08.866+0100	DEBUG	retrying request	{"request": "GET https://search.maven.org/solrsearch/select?q=1%3A%2262c7299ced2a089cc541726c6d763da9417604a0%22&rows=1&wt=json (status: 504)", "timeout": "20s", "remaining": 5}
2023-01-18T15:32:08.866+0100	DEBUG	retrying request	{"request": "GET https://search.maven.org/solrsearch/select?q=g%3A%22org.objectweb%22+AND+a%3A%22ASM%2C+a+very+small+and+fast+Java+bytecode+manipul%22&rows=1 (status: 504)", "timeout": "20s", "remaining": 5}
2023-01-18T15:32:08.902+0100	DEBUG	retrying request	{"request": "GET https://search.maven.org/solrsearch/select?q=1%3A%22cbfd23477421146a4cf43a4a36c63d15508938cc%22&rows=1&wt=json (status: 504)", "timeout": "20s", "remaining": 5}
2023-01-18T15:32:08.998+0100	DEBUG	retrying request	{"request": "GET https://search.maven.org/solrsearch/select?q=g%3A%22com.github.ben-manes%22+AND+a%3A%22com.github.ben-manes.caffeine%22&rows=1 (status: 504)", "timeout": "20s", "remaining": 5}
2023-01-18T15:32:09.497+0100	DEBUG	retrying request	{"request": "GET https://search.maven.org/solrsearch/select?q=1%3A%229858bd469947a8e93a42755d79d7b682bd1ad754%22&rows=1&wt=json (status: 504)", "timeout": "20s", "remaining": 5}
2023-01-18T15:32:12.143+0100	DEBUG	retrying request	{"request": "GET https://search.maven.org/solrsearch/select?q=1%3A%2201ea52701a46f9a9005f4b24a9d41c4813c36412%22&rows=1&wt=json (status: 504)", "timeout": "20s", "remaining": 5}
2023-01-18T15:32:28.905+0100	DEBUG	No such POM in the central repositories	{"file": "bootstrap.jar"}

and the scan will ultimately fail with

2023-01-18T15:35:56.898+0100	FATAL	image scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.Run
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:397
  - scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:257
  - scan failed:
    github.com/aquasecurity/trivy/pkg/commands/artifact.scan
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:588
  - failed analysis:
    github.com/aquasecurity/trivy/pkg/scanner.Scanner.ScanArtifact
        /home/runner/work/trivy/trivy/pkg/scanner/scan.go:146
  - analyze error:
    github.com/aquasecurity/trivy/pkg/fanal/artifact/image.Artifact.Inspect
        /home/runner/work/trivy/trivy/pkg/fanal/artifact/image/image.go:127
  - timeout:
    github.com/aquasecurity/trivy/pkg/fanal/artifact/image.Artifact.inspect
        /home/runner/work/trivy/trivy/pkg/fanal/artifact/image/image.go:248
  - context deadline exceeded

[stranljip]

Ok - there seems to be a major problem with search.maven.org: https://status.maven.org/uptime/sb07mgy2l405

[tegioz]

Oops.. good catch! 👍