DB support on s390x

[p4yl04d3r]

Description

What did you expect to happen?

Expected Trivy scan to complete without fatal error and scan container.

What happened instead?

2022-09-14T15:42:27.253-0400 FATAL init error: DB error: error in vulnerability DB initialize: failed to open db: invalid database

Output of run with -debug:

$ trivy  -d image my-image:v1
2022-09-14T15:48:19.187-0400	DEBUG	Severities: ["UNKNOWN" "LOW" "MEDIUM" "HIGH" "CRITICAL"]
2022-09-14T15:48:19.189-0400	DEBUG	cache dir:  /home/cloud-user/.cache/trivy
2022-09-14T15:48:19.189-0400	DEBUG	DB update was skipped because the local DB is the latest
2022-09-14T15:48:19.189-0400	DEBUG	DB Schema: 2, UpdatedAt: 2022-09-14 18:07:58.678007427 +0000 UTC, NextUpdate: 2022-09-15 00:07:58.678006827 +0000 UTC, DownloadedAt: 2022-09-14 19:21:13.228368094 +0000 UTC
2022-09-14T15:48:19.189-0400	FATAL	init error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.Run
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:362
  - DB error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.NewRunner
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:121
  - error in vulnerability DB initialize:
    github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).initDB
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:284
  - failed to open db:
    github.com/aquasecurity/trivy-db/pkg/db.Init
        /home/runner/go/pkg/mod/github.com/aquasecurity/[email protected]/pkg/db/db.go:83
  - invalid database

Output of trivy -v:

$ trivy -v
Version: 0.31.3
Vulnerability DB:
  Version: 2
  UpdatedAt: 2022-09-14 18:07:58.678007427 +0000 UTC
  NextUpdate: 2022-09-15 00:07:58.678006827 +0000 UTC
  DownloadedAt: 2022-09-14 19:21:13.228368094 +0000 UTC

Additional details (base image name, container registry info...):

This container image is based on RH ubi8, locally built on the same system with "docker build .", I do not think the scanner got to a point that it actually started to scan the container.

[p4yl04d3r]

Started to look into the issue reported.

Issue with BoltDB OPEN call
Line 83 in "aquasecurity/trivy-db/blob/main/pkg/db/db.go":

db, err = bolt.Open(dbPath, 0600, nil)
	if err != nil {
		return xerrors.Errorf("failed to open db: %w", err)
	}

BoltDB documents in "boltdb/bolt/blob/master/errors.go"

// ErrInvalid is returned when both meta pages on a database are invalid.
	// This typically occurs when a file is not a bolt database.
	ErrInvalid = errors.New("invalid database")

Could this be an Endian issue on Big Endian systems?
Reading Bold documentation on limitations states that Bolt databases are Memory Mapped and cannot be move from one Endian to another.

"The data structures in the Bolt database are memory mapped so the data file will be endian specific. This means that you cannot copy a Bolt file from a little endian machine to a big endian machine and have it work. For most users this is not a concern since most modern CPUs are little endian."

I'm going to check if there is another version of the trivia.db for big endian.

[p4yl04d3r]

I'm attempting to build the Trivy-DB locally as that should resolve the issue in the immediate time frame. Although, i have issue with trivy-db because of issue with the vuln-list missing artifacts on Ruby Gems. I'll take that up with those projects.

[p4yl04d3r]

Built Trivy-DB locally. I can now run trivy against containers on s390x.
The issue was with the DB downloaded when Trivy runs for the first time or updates its vulnerabilities.

[knqyf263]

Thanks for updating! Do you have any idea about building Trivy DB on s390x?

[p4yl04d3r]

The process to build trivy-db was the same as any other platform. I used the containerized method to build the current DB as it solved the dependencies to build the DB for me.
Then asked Trivy to NOT update the DB (--skip-update).
You cannot run a Trivy DB built on a little endian architecture on big endian. And vice-versa because of how BOLT (The DB that Trivy is built on) places data into the DB.
Although Trivy is built for s390x, It took a bit of effort to get the correct vulnerability DB in place to actually use it.
Trivy need to detect and provide the correct DB for the arch its being deployed on.

[knqyf263]

Is there any way to build the database for s390x on GitHub Actions?

[p4yl04d3r]

docker x is an option to build the DB against another architecture including s390x.
But let me find out about github actions.