"trivy server" not downloading ghcr.io/aquasecurity/trivy-java-db:1, only ghcr.io/aquasecurity/trivy-db:2

[huornlmj]

Description

trivy server not downloading ghcr.io/aquasecurity/trivy-java-db:1, only ghcr.io/aquasecurity/trivy-db:2.

Desired Behavior

Client should have both databases available from server.

Actual Behavior

Client only gets the trivy-db:2 database

Reproduction Steps

Example is as follows:

Server

$ trivy server
2024-11-06T12:07:21Z    INFO    [vulndb] Need to update DB
2024-11-06T12:07:21Z    INFO    [vulndb] Downloading vulnerability DB...
2024-11-06T12:07:21Z    INFO    [vulndb] Downloading artifact...        repo="ghcr.io/aquasecurity/trivy-db:2"
2024-11-06T12:07:27Z    INFO    [vulndb] Artifact successfully downloaded       repo="ghcr.io/aquasecurity/trivy-db:2"
2024-11-06T12:07:28Z    INFO    Listening localhost:4954...

Client

$ trivy image --server http://localhost:4954 nginx:latest
2024-11-06T12:12:49Z    WARN    Trivy runs in client/server mode, but misconfiguration and license scanning will be done on the client side, see https://aquasecurity.github.io/trivy/v0.56/docs/references/modes/client-server
2024-11-06T12:12:49Z    INFO    [vuln] Vulnerability scanning is enabled
2024-11-06T12:12:49Z    INFO    [secret] Secret scanning is enabled
2024-11-06T12:12:49Z    INFO    [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-06T12:12:49Z    INFO    [secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-11-06T12:13:05Z    INFO    [javadb] Downloading Java DB...
2024-11-06T12:13:05Z    INFO    [javadb] Downloading artifact...        repo="ghcr.io/aquasecurity/trivy-java-db:1"
2024-11-06T12:13:06Z    ERROR   [javadb] Failed to download artifact    repo="ghcr.io/aquasecurity/trivy-java-db:1" err="oci download error: failed to fetch the layer: GET https://ghcr.io/v2/aquasecurity/trivy-java-db/blobs/sha256:af58d52d14d07b8fbbdf07437bcc66f8b40113316d39affd77bcfaee2542b135: TOOMANYREQUESTS: retry-after: 527.441µs, allowed: 44000/minute"
2024-11-06T12:13:06Z    FATAL   Fatal error     image scan error: scan error: scan failed: failed analysis: analyze error: pipeline error: failed to analyze layer (sha256:72db5db515fdd9ae82b759fc207fdfbcc31567c28bb87950abc94ce1d60b2d40): post analysis error: post analysis error: Unable to initialize the Java DB: Java DB update failed: OCI artifact error: failed to download Java DB: failed to download artifact from any source

### Target

None

### Scanner

None

### Output Format

None

### Mode

None

### Debug Output

```bash
Already shown above

Operating System

Ubuntu 22.04.2 LTS

Version

$ trivy version
Version: 0.56.1
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-11-06 06:16:54.604591472 +0000 UTC
  NextUpdate: 2024-11-07 06:16:54.604591091 +0000 UTC
  DownloadedAt: 2024-11-06 12:07:27.977123412 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2024-10-04 02:32:10.066516514 +0000 UTC
  NextUpdate: 2024-10-07 02:32:10.066515923 +0000 UTC
  DownloadedAt: 2024-10-04 13:32:46.533580823 +0000 UTC
Check Bundle:
  Digest: sha256:ae151c4eecf35c507d8f866121ddfbf46540b041bc7bca7cdd8d9f70ceb6f12c
  DownloadedAt: 2024-10-21 12:53:02.733904373 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[nikpivkin]

Duplicate of #7538

[nikpivkin]

@knqyf263 Maybe we should add information about JavaDB in client/server mode to the documentation?

[nikpivkin]

@huornlmj Right, but why do you think the server should store JavaDB? JavaDB is needed to get information about Java artifact during client-side JAR analysis.

[huornlmj]

It raises the question, why would you use server/client mode if the server only provides half the database and the client has to go get the other? I came to this discovery based on the current aforementioned Github throttling issues, as I expect many will too. The expectation here was that a single server could feed many trivy clients for their databases. Alas we now see this is not the case. So why not make the server serve both databases? Why is it only going to serve one?

[knqyf263]

Here is the context. We do understand it's better to download the Java DB on the server side, but it requires a lot of effort.
#3560

[knqyf263]

@nikpivkin Yes, we should document it.