search

yokawasa / gitrivy

Trivy with GitHub Actions
MIT License
2 stars 1 forks source link

Handle timeout: context deadline exceeded #5

Closed yokawasa closed 3 years ago

yokawasa commented 3 years ago

Whether the image has vulnerability or not, a trivy command, which is run internally in gitriy, fails due to timeout: context deadline exceeded (see while error message below). So it would be better if we could take either options below

Error: Error: Failed vulnerability scan using Trivy.
      stdout: 
      stderr: 2021-10-14T00:18:45.849Z  FATAL   scan error: image scan failed: failed analysis: analyze error: timeout: context deadline exceeded

      error: undefined
yokawasa commented 3 years ago

suggestions Add timeout parameter so that the users can adjust trivy timeout to avoid timeout exception

See --timeout param

trivy image -h 

COMMANDS:
   image, i          scan an image
   filesystem, fs    scan local filesystem for language-specific dependencies and config files
   rootfs            scan rootfs
   repository, repo  scan remote repository
   client, c         client mode
   server, s         server mode
   config, conf      scan config files
   plugin, p         manage plugins
   help, h           Shows a list of commands or help for one command

GLOBAL OPTIONS:
   --quiet, -q        suppress progress bar and log output (default: false) [$TRIVY_QUIET]
   --debug, -d        debug mode (default: false) [$TRIVY_DEBUG]
   --cache-dir value  cache directory (default: "/Users/yoichi.kawasaki/Library/Caches/trivy") [$TRIVY_CACHE_DIR]
   --help, -h         show help (default: false)
   --version, -v      print the version (default: false)
(venv3.8) ➜  zozo-aggregation-api git:(use-gitrivy-v3.0.3) ~/bin/trivy-packages/trivy_0.20.1/trivy image -h
NAME:
   trivy image - scan an image

USAGE:
   trivy image [command options] image_name

OPTIONS:
   --template value, -t value       output template [$TRIVY_TEMPLATE]
   --format value, -f value         format (table, json, template) (default: "table") [$TRIVY_FORMAT]
   --input value, -i value          input file path instead of image name [$TRIVY_INPUT]
   --severity value, -s value       severities of vulnerabilities to be displayed (comma separated) (default: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL") [$TRIVY_SEVERITY]
   --output value, -o value         output file name [$TRIVY_OUTPUT]
   --exit-code value                Exit code when vulnerabilities were found (default: 0) [$TRIVY_EXIT_CODE]
   --skip-db-update, --skip-update  skip updating vulnerability database (default: false) [$TRIVY_SKIP_UPDATE, $TRIVY_SKIP_DB_UPDATE]
   --download-db-only               download/update vulnerability database but don't run a scan (default: false) [$TRIVY_DOWNLOAD_DB_ONLY]
   --reset                          remove all caches and database (default: false) [$TRIVY_RESET]
   --clear-cache, -c                clear image caches without scanning (default: false) [$TRIVY_CLEAR_CACHE]
   --no-progress                    suppress progress bar (default: false) [$TRIVY_NO_PROGRESS]
   --ignore-unfixed                 display only fixed vulnerabilities (default: false) [$TRIVY_IGNORE_UNFIXED]
   --removed-pkgs                   detect vulnerabilities of removed packages (only for Alpine) (default: false) [$TRIVY_REMOVED_PKGS]
   --vuln-type value                comma-separated list of vulnerability types (os,library) (default: "os,library") [$TRIVY_VULN_TYPE]
   --security-checks value          comma-separated list of what security issues to detect (vuln,config) (default: "vuln") [$TRIVY_SECURITY_CHECKS]
   --ignorefile value               specify .trivyignore file (default: ".trivyignore") [$TRIVY_IGNOREFILE]
   --timeout value                  timeout (default: 5m0s) [$TRIVY_TIMEOUT]
   --light                          light mode: it's faster, but vulnerability descriptions and references are not displayed (default: false) [$TRIVY_LIGHT]
   --ignore-policy value            specify the Rego file to evaluate each vulnerability [$TRIVY_IGNORE_POLICY]
   --list-all-pkgs                  enabling the option will output all packages regardless of vulnerability (default: false) [$TRIVY_LIST_ALL_PKGS]
   --cache-backend value            cache backend (e.g. redis://localhost:6379) (default: "fs") [$TRIVY_CACHE_BACKEND]
   --skip-files value               specify the file paths to skip traversal [$TRIVY_SKIP_FILES]
   --skip-dirs value                specify the directories where the traversal is skipped [$TRIVY_SKIP_DIRS]
   --help, -h                       show help (default: false)