Trivy with Azure DevOps Pipeline Task Errors

[3rk1n]

Question

We are using Azure DevOps Pipeline with Trivy to scan images as belowed task.

    - task: trivy@1
      inputs:
        version: 'latest'
        docker: false
        debug: true
        loginDockerConfig: true
        image: '$(trviy_containerregistery)/$(trviy_containername):$(build.buildid)'
        severities: 'CRITICAL'

I have some questions from the debug output.

1. The "latest" version tag is not working properly; the latest image version is v0.51.1 but this task work with v0.38.2

Run requested using local Trivy binary...
Finding correct Trivy version to install...
Required Trivy version is v0.38.2
##[debug]rm -rf /tmp/trivy
Downloading Trivy...
##[debug]/tmp/trivy
##[debug]testing directory '/tmp'
Downloading: https://github.com/aquasecurity/trivy/releases/download/v0.38.2/trivy_0.38.2_Linux-64bit.tar.gz

2. There are some error messages which are belowed

2024-05-14T07:40:42.985Z	     [FATAL]	image scan error:
2024-05-14T07:40:43.0292035Z     github.com/aquasecurity/trivy/pkg/commands/artifact.Run
2024-05-14T07:40:43.0292390Z         /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:427
2024-05-14T07:40:43.0292689Z   - scan error:
2024-05-14T07:40:43.0292943Z     github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact
2024-05-14T07:40:43.0293193Z         /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:266
2024-05-14T07:40:43.0293470Z   - scan failed:
2024-05-14T07:40:43.0293679Z     github.com/aquasecurity/trivy/pkg/commands/artifact.scan
2024-05-14T07:40:43.0294158Z         /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:669
2024-05-14T07:40:43.0294391Z   - failed analysis:
2024-05-14T07:40:43.0294644Z     github.com/aquasecurity/trivy/pkg/scanner.Scanner.ScanArtifact
2024-05-14T07:40:43.0294921Z         /home/runner/work/trivy/trivy/pkg/scanner/scan.go:146
2024-05-14T07:40:43.0295182Z   - analyze error:
2024-05-14T07:40:43.0295377Z     github.com/aquasecurity/trivy/pkg/fanal/artifact/image.Artifact.Inspect
2024-05-14T07:40:43.0295693Z         /home/runner/work/trivy/trivy/pkg/fanal/artifact/image/image.go:139
2024-05-14T07:40:43.0296163Z   - failed to analyze layer (sha256:2200575a6de50ee0424f4474abc10dd11f937921e838ed16c4201ca3dc7e0116):
2024-05-14T07:40:43.0296504Z     github.com/aquasecurity/trivy/pkg/fanal/artifact/image.Artifact.inspect.func1
2024-05-14T07:40:43.0296756Z         /home/runner/work/trivy/trivy/pkg/fanal/artifact/image/image.go:242
2024-05-14T07:40:43.0297083Z   - post handler error:
2024-05-14T07:40:43.0297410Z     github.com/aquasecurity/trivy/pkg/fanal/artifact/image.Artifact.inspectLayer
2024-05-14T07:40:43.0297754Z         /home/runner/work/trivy/trivy/pkg/fanal/artifact/image/image.go:347
2024-05-14T07:40:43.0297995Z   - post handler error:
2024-05-14T07:40:43.0298244Z     github.com/aquasecurity/trivy/pkg/fanal/handler.Manager.PostHandle
2024-05-14T07:40:43.0298543Z         /home/runner/work/trivy/trivy/pkg/fanal/handler/handler.go:75
2024-05-14T07:40:43.0298834Z   - misconfiguration scan error:
2024-05-14T07:40:43.0299061Z     github.com/aquasecurity/trivy/pkg/fanal/handler/misconf.misconfPostHandler.Handle
2024-05-14T07:40:43.0299364Z         /home/runner/work/trivy/trivy/pkg/fanal/handler/misconf/misconf.go:45
2024-05-14T07:40:43.0299643Z   - scan config error:
2024-05-14T07:40:43.0299878Z     github.com/aquasecurity/trivy/pkg/misconf.(*Scanner).Scan
2024-05-14T07:40:43.0300179Z         /home/runner/work/trivy/trivy/pkg/misconf/scanner.go:300
2024-05-14T07:40:43.0300525Z   - 4 errors occurred:
2024-05-14T07:40:43.0300854Z policies/cloud/policies/aws/rds/disable_cluster_skip_final_snapshot.rego:26: rego_type_error: undefined ref: cluster.skipfinalsnapshot.value
2024-05-14T07:40:43.0301198Z 	cluster.skipfinalsnapshot.value
2024-05-14T07:40:43.0301346Z 	        ^
2024-05-14T07:40:43.0301535Z 	        have: "skipfinalsnapshot"
2024-05-14T07:40:43.0301851Z 	        want (one of): ["backupretentionperioddays" "encryption" "engine" "instances" "performanceinsights" "publicaccess" "replicationsourcearn"]
2024-05-14T07:40:43.0302264Z policies/cloud/policies/aws/rds/disable_cluster_skip_final_snapshot.rego:27: rego_type_error: undefined ref: cluster.skipfinalsnapshot
2024-05-14T07:40:43.0302526Z 	cluster.skipfinalsnapshot
2024-05-14T07:40:43.0302713Z 	        ^
2024-05-14T07:40:43.0302897Z 	        have: "skipfinalsnapshot"
2024-05-14T07:40:43.0303272Z 	        want (one of): ["backupretentionperioddays" "encryption" "engine" "instances" "performanceinsights" "publicaccess" "replicationsourcearn"]
2024-05-14T07:40:43.0303661Z policies/cloud/policies/aws/rds/enable_cluster_deletion_protection.rego:26: rego_type_error: undefined ref: cluster.deletionprotection.value
2024-05-14T07:40:43.0303991Z 	cluster.deletionprotection.value
2024-05-14T07:40:43.0304202Z 	        ^
2024-05-14T07:40:43.0304386Z 	        have: "deletionprotection"
2024-05-14T07:40:43.0304643Z 	        want (one of): ["backupretentionperioddays" "encryption" "engine" "instances" "performanceinsights" "publicaccess" "replicationsourcearn"]
2024-05-14T07:40:43.0305131Z policies/cloud/policies/aws/rds/enable_cluster_deletion_protection.rego:27: rego_type_error: undefined ref: cluster.deletionprotection
2024-05-14T07:40:43.0305446Z 	cluster.deletionprotection
2024-05-14T07:40:43.0305633Z 	        ^
2024-05-14T07:40:43.0305768Z 	        have: "deletionprotection"
2024-05-14T07:40:43.0306080Z 	        want (one of): ["backupretentionperioddays" "encryption" "engine" "instances" "performanceinsights" "publicaccess" "replicationsourcearn"]
2024-05-14T07:40:43.0327690Z ##[error]Failed: Trivy detected problems.
##[debug]Processed: ##vso[task.issue type=error;]Failed: Trivy detected problems.
##[debug]Processed: ##vso[task.complete result=Failed;]Failed: Trivy detected problems.
Publishing JSON results...
##[debug]Processed: ##vso[task.addattachment type=JSON_RESULT;name=trivy0.7984329206891057.json;]/tmp/trivy-results-0.7395913090757777.json
Done!

Target

Container Image

Scanner

None

Output Format

Table

Mode

None

Operating System

No response

Version

No response

[simar7]

I've created a PR to fix the extension as it needs to use the latest version of Trivy aquasecurity/trivy-azure-pipelines-task#63

[mcsdodo]

Is anyone going to loog at the PR please?