Getting Trivy version takes a long time

[SimonWoidig]

Name and Version

bitnami/harbor-adapter-trivy:2.10.2-debian-12-r4

What architecture are you using?

amd64

What steps will reproduce the bug?

1. run the harbor-adapter-trivy with default config and command
2. exec into the container
3. run time trivy --version

What is the expected behavior?

The execution should be relatively fast (sub-secon) and the version is shown.

What do you see instead?

The version is shown but the execution takes seconds.
This is a problem because when Harbor calls this adapter - /api/v1/metadata, the scanner is marked as unavailable.

Additional information

This issue concerns the slowness of the version subcommand aquasecurity/harbor-scanner-trivy#341.
The issue seems to be fixed in v0.51.1.

[carrodher]

Please note that Bitnami already released the latest version of Trivy at https://github.com/bitnami/containers/tree/main/bitnami/trivy. In this case, we need to wait until the upstream Harbor team cuts a new release for harbor-scanner-trivy bumping the bundled Trivy version.
I suggest you open a ticket like this one there.

[SimonWoidig]

@carrodher
Well I've mentioned an issue from the very repo you are pointing to. The issue is solved there. The fixed version is 0.51.1.
Bitnami harbor-adapter-trivy Trivy tool version:

docker pull docker.io/bitnami/harbor-adapter-trivy:2.10.2-debian-12-r4                                                                                                                                  main
2.10.2-debian-12-r4: Pulling from bitnami/harbor-adapter-trivy
Digest: sha256:d460d52042051b22a4a5612310484ea8e3e103bd2299c78d652576ad04ebfc79
Status: Image is up to date for bitnami/harbor-adapter-trivy:2.10.2-debian-12-r4
docker.io/bitnami/harbor-adapter-trivy:2.10.2-debian-12-r4

docker run -it --rm --name trivy --entrypoint trivy docker.io/bitnami/harbor-adapter-trivy:2.10.2-debian-12-r4 --version                                                                                main
Version: 0.50.1

Aquasec harbor-scanner-trivy Trivy tool version:

docker pull aquasec/harbor-scanner-trivy:0.31.2                                                                                                                                                     130 main
0.31.2: Pulling from aquasec/harbor-scanner-trivy
Digest: sha256:6e790e233872f70eafee5e2cc1ef2c9601f14bebd524d4a077cf2099533f2f30
Status: Image is up to date for aquasec/harbor-scanner-trivy:0.31.2
docker.io/aquasec/harbor-scanner-trivy:0.31.2

docker run -it --rm --entrypoint trivy aquasec/harbor-scanner-trivy:0.31.2 --version
Version: 0.51.2

The solution is to release a new Bitnami harbor-adapter-trivy image with Trivy updated.

[carrodher]

That new harbor-adapter-trivy version was released yesterday, see aquasecurity/harbor-scanner-trivy#478. Our automated test and release pipeline detected the new version; however, we have identified some issues during the packaging process that require manual intervention.

Our team is actively addressing these issues at the moment. We are committed to resolving them as quickly as possible. We will provide updates on this thread as soon as the new version is successfully released.

[SimonWoidig]

I see. Thanks!

[github-actions]

This Issue has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thanks for the feedback.