Issue with trivy plugin on azure devops - running timeout even after 1h

[sebaandrei]

HI, From some time ago, without changing anything, trivy plugin on azure devops, that scans our docker images, fails. Running same command locally, works fine in few minutes, but on azure devops it's going timeout even after 1hr. Below full logs of a failed pipeline.

"/tmp/trivy --debug image --exit-code 0 --format json --output /tmp/trivy-results-0.6494861920786035.json --security-checks vuln,config,secret --severity CRITICAL,HIGH --timeout 15m0s tpo-optimisation-core:402f8b74 2023-11-16T13:18:02.090Z WARN '--security-checks' is deprecated. Use '--scanners' instead. 2023-11-16T13:18:02.094Z DEBUG Severities: ["CRITICAL" "HIGH"] 2023-11-16T13:18:02.099Z DEBUG cache dir: /home/vsts/.cache/trivy

[error]Failed: Trivy detected problems.

2023-11-16T13:18:02.099Z DEBUG There is no valid metadata file: unable to open a file: open /home/vsts/.cache/trivy/db/metadata.json: no such file or directory 2023-11-16T13:18:02.099Z INFO Need to update DB Publishing JSON results... 2023-11-16T13:18:02.099Z INFO DB Repository: ghcr.io/aquasecurity/trivy-db 2023-11-16T13:18:02.099Z INFO Downloading DB... Done! 2023-11-16T13:18:02.099Z DEBUG no metadata file

2023-11-16T13:18:04.617Z DEBUG DB Schema: 2, UpdatedAt: 2023-11-16 12:11:26.83817481 +0000 UTC, NextUpdate: 2023-11-16 18:11:26.838174399 +0000 UTC, DownloadedAt: 2023-11-16 13:18:04.617435101 +0000 UTC 2023-11-16T13:18:04.617Z INFO Vulnerability scanning is enabled 2023-11-16T13:18:04.617Z DEBUG Vulnerability type: [os library] 2023-11-16T13:18:04.617Z INFO Misconfiguration scanning is enabled 2023-11-16T13:18:04.617Z DEBUG Failed to open the policy metadata: open /home/vsts/.cache/trivy/policy/metadata.json: no such file or directory 2023-11-16T13:18:04.617Z INFO Need to update the built-in policies 2023-11-16T13:18:04.617Z INFO Downloading the built-in policies... 44.66 KiB / 44.66 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2023-11-16T13:18:05.299Z DEBUG Digest of the built-in policies: sha256:1df8ade71efc830877ca3b1130f83e0c6368e3a45b0d4c0f0418955501644054 2023-11-16T13:18:05.299Z DEBUG Policies successfully loaded from disk 2023-11-16T13:18:05.299Z INFO Secret scanning is enabled 2023-11-16T13:18:05.299Z INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning 2023-11-16T13:18:05.299Z INFO Please see also https://aquasecurity.github.io/trivy/v0.38/docs/secret/scanning/#recommendation for faster secret detection 2023-11-16T13:18:05.304Z DEBUG No secret config detected: trivy-secret.yaml 2023-11-16T13:18:05.304Z DEBUG Image ID: sha256:d9d5d90bc2c689f48e34cd6f738f5fcd4834ea622466a45499c40841ef26a15a 2023-11-16T13:18:05.304Z DEBUG Diff IDs: [sha256:74c0af6e02274b54b88f851843ae69880a234694dede8ff9fb93bfa076af45ed sha256:baf87c49ca6b8d40680760e3af0fbf2339b0dbabb7dff90c0ef426df32ac20de sha256:04d613b891f57ce67806043e739eea4dd94c5f7b5c76431972bb1a6af11a0316 sha256:b6356273eecdbe218c689e81de59c757c3b9354c27e724f4587a15f610cd3ed8 sha256:6569c6d67963fe3261e23a3fc921acafb55740bff1b62db6a495838acec66f8c sha256:22020866532fd5ae4480d02e57c8d4a5b1d7a59fb0f6752872bf6593114056a1 sha256:ba362af1da9704b92ed6e40a5d63629098d80b0ddef50cfe29ced635588abd16 sha256:b66487139c561c78ae031f8a4de0cf579000607abb6ab5a72f15156151c9ed3e sha256:e40861124aa48470a83fc3ca4b82883ba2f8315595f26954f9e9e82a47d33ad3 sha256:78be68b31a389ae567fc1ad87bbb88d2af5640204464ed4b215d6863c6e9c9b3 sha256:7e49dcf422145072095c3cb94458d14661903d78241466d2e8c084d42ed9b2b3 sha256:4f841799b5f27f938f948c212b3aa6b9d281c94070855acb01ca86b461107cce sha256:d82c713e0285bd996c27c8cecd5c354a23d5ee4ac5bb6430416933e872bb392e sha256:244f669b40109e7369aa56d038d2ec4dcb683513a3cf4f7e18978cb8330325c7] 2023-11-16T13:18:05.304Z DEBUG Base Layers: [sha256:74c0af6e02274b54b88f851843ae69880a234694dede8ff9fb93bfa076af45ed sha256:baf87c49ca6b8d40680760e3af0fbf2339b0dbabb7dff90c0ef426df32ac20de sha256:04d613b891f57ce67806043e739eea4dd94c5f7b5c76431972bb1a6af11a0316 sha256:b6356273eecdbe218c689e81de59c757c3b9354c27e724f4587a15f610cd3ed8 sha256:6569c6d67963fe3261e23a3fc921acafb55740bff1b62db6a495838acec66f8c sha256:22020866532fd5ae4480d02e57c8d4a5b1d7a59fb0f6752872bf6593114056a1 sha256:ba362af1da9704b92ed6e40a5d63629098d80b0ddef50cfe29ced635588abd16] 2023-11-16T13:18:05.401Z DEBUG Missing image ID in cache: sha256:d9d5d90bc2c689f48e34cd6f738f5fcd4834ea622466a45499c40841ef26a15a 2023-11-16T13:18:05.401Z DEBUG Missing diff ID in cache: sha256:6569c6d67963fe3261e23a3fc921acafb55740bff1b62db6a495838acec66f8c 2023-11-16T13:18:05.401Z DEBUG Missing diff ID in cache: sha256:baf87c49ca6b8d40680760e3af0fbf2339b0dbabb7dff90c0ef426df32ac20de 2023-11-16T13:18:05.401Z DEBUG Missing diff ID in cache: sha256:74c0af6e02274b54b88f851843ae69880a234694dede8ff9fb93bfa076af45ed 2023-11-16T13:18:05.401Z DEBUG Missing diff ID in cache: sha256:b6356273eecdbe218c689e81de59c757c3b9354c27e724f4587a15f610cd3ed8 2023-11-16T13:18:05.402Z DEBUG Missing diff ID in cache: sha256:04d613b891f57ce67806043e739eea4dd94c5f7b5c76431972bb1a6af11a0316 2023-11-16T13:18:28.141Z DEBUG Missing diff ID in cache: sha256:22020866532fd5ae4480d02e57c8d4a5b1d7a59fb0f6752872bf6593114056a1 2023-11-16T13:18:28.761Z DEBUG Missing diff ID in cache: sha256:ba362af1da9704b92ed6e40a5d63629098d80b0ddef50cfe29ced635588abd16 2023-11-16T13:18:29.264Z DEBUG Missing diff ID in cache: sha256:b66487139c561c78ae031f8a4de0cf579000607abb6ab5a72f15156151c9ed3e 2023-11-16T13:18:29.435Z DEBUG Missing diff ID in cache: sha256:e40861124aa48470a83fc3ca4b82883ba2f8315595f26954f9e9e82a47d33ad3 2023-11-16T13:18:30.569Z DEBUG Missing diff ID in cache: sha256:78be68b31a389ae567fc1ad87bbb88d2af5640204464ed4b215d6863c6e9c9b3 2023-11-16T13:18:31.552Z DEBUG Missing diff ID in cache: sha256:7e49dcf422145072095c3cb94458d14661903d78241466d2e8c084d42ed9b2b3 2023-11-16T13:18:31.555Z DEBUG Missing diff ID in cache: sha256:4f841799b5f27f938f948c212b3aa6b9d281c94070855acb01ca86b461107cce 2023-11-16T13:18:32.171Z DEBUG Analysis error: go binary (filepath: usr/local/lib/python3.11/site-packages/numpy.libs/libgfortran-040039e1.so.5.0.0) parse error: EOF 2023-11-16T13:18:32.297Z DEBUG Analysis error: go binary (filepath: usr/local/lib/python3.11/site-packages/numpy.libs/libopenblas64_p-r0-0cf96a72.3.23.dev.so) parse error: EOF 2023-11-16T13:18:32.318Z DEBUG Analysis error: go binary (filepath: usr/local/lib/python3.11/site-packages/numpy.libs/libquadmath-96973f99.so.0.0.0) parse error: EOF 2023-11-16T13:18:32.338Z DEBUG Analysis error: go binary (filepath: usr/local/lib/python3.11/site-packages/numpy/core/_multiarray_umath.cpython-311-x86_64-linux-gnu.so) parse error: EOF 2023-11-16T13:18:32.367Z DEBUG Analysis error: go binary (filepath: usr/local/lib/python3.11/site-packages/numpy/linalg/lapack_lite.cpython-311-x86_64-linux-gnu.so) parse error: EOF 2023-11-16T13:18:32.393Z DEBUG Analysis error: go binary (filepath: usr/local/lib/python3.11/site-packages/numpy/linalg/_umath_linalg.cpython-311-x86_64-linux-gnu.so) parse error: EOF 2023-11-16T13:18:32.574Z DEBUG Analysis error: go binary (filepath: usr/local/lib/python3.11/site-packages/pyodbc.cpython-311-x86_64-linux-gnu.so) parse error: EOF 2023-11-16T13:33:02.350Z WARN Increase --timeout value 2023-11-16T13:33:02.350Z FATAL image scan error: github.com/aquasecurity/trivy/pkg/commands/artifact.Run /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:427

scan error: github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:266 scan failed: github.com/aquasecurity/trivy/pkg/commands/artifact.scan /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:669 failed analysis: github.com/aquasecurity/trivy/pkg/scanner.Scanner.ScanArtifact /home/runner/work/trivy/trivy/pkg/scanner/scan.go:146 analyze error: github.com/aquasecurity/trivy/pkg/fanal/artifact/image.Artifact.Inspect /home/runner/work/trivy/trivy/pkg/fanal/artifact/image/image.go:139 semaphore acquire: github.com/aquasecurity/trivy/pkg/fanal/artifact/image.Artifact.inspect /home/runner/work/trivy/trivy/pkg/fanal/artifact/image/image.go:223 context deadline exceeded Finishing: Scan DEV image for vulnerabilities"

[johngraumann]

I am having the exact same issue. Increasing the timeout has no effect.

[johngraumann]

I changed the version in the settings to an explicit version rather than "latest" and it seems to work now:

• task: trivy@1 displayName: 'Trivy vulnerability scan' inputs: version: 'v0.48.2'

[sebaandrei]

Same change fixed also for me. Thanks