Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Failed to download trivy

See original GitHub issue

We are trying to integrate this action with one of our current workflows in a private repo, but our workflow keeps failing with the following error:

Error: Failed to download trivy from https://github.com/aquasecurity/trivy/releases/download/v0.16.0/trivy_0.16.0_Linux-64bit.tar.gz

I went ahead and enabled additional logging by setting the ACTIONS_RUNNER_DEBUG and ACTIONS_STEP_DEBUG secrets to true, and we are seeing the following logs:

Could not find allowedlist file.
##[debug]Downloading https://api.github.com/repos/aquasecurity/trivy/releases/latest
##[debug]Downloading /home/runner/work/_temp/8472635f-cf05-4075-a5c2-b755d65851c4
##[debug]download complete
##[debug]isExplicit: 0.16.0
##[debug]explicit? true
##[debug]checking cache: /opt/hostedtoolcache/trivy/0.16.0/x64
##[debug]not found
##[debug]Could not find trivy in cache, downloading from https://github.com/aquasecurity/trivy/releases/download/v0.16.0/trivy_0.16.0_Linux-64bit.tar.gz
##[debug]Downloading https://github.com/aquasecurity/trivy/releases/download/v0.16.0/trivy_0.16.0_Linux-64bit.tar.gz
##[debug]Downloading /home/runner/work/****/****/_temp/tools/trivy
Error: Failed to download trivy from https://github.com/aquasecurity/trivy/releases/download/v0.16.0/trivy_0.16.0_Linux-64bit.tar.gz
##[debug]Node Action run completed with exit code 1
##[debug]Finishing: Scan Docker Image

Additional information about environment:

Current runner version: '2.277.1'
Operating System
  Ubuntu
  20.04.2
  LTS
Virtual Environment
  Environment: ubuntu-20.04
  Version: 20210208.0
  Included Software: https://github.com/actions/virtual-environments/blob/ubuntu20/20210208.0/images/linux/Ubuntu2004-README.md

By chance, has anyone else ran into this issue before?

Issue Analytics

State:
Created 3 years ago
Comments:13 (8 by maintainers)

Top GitHub Comments

1reaction

scottwestovercommented, Mar 10, 2021

Thanks for the quick response. We haven’t been able to pin down how this one branch/repo is different, will try to investigate further.

I also tried to recreate the issue, and have had no success in doing so. We are able to run this action on the non-default branch in this repo, and it downloads trivy without any issues. However, as soon as I setup this action on our develop branch, it fails. I also tried creating a new branch that is not the default branch, and I ran into the same issue.

1reaction

shigupt202commented, Feb 17, 2021

@scottwestover Are you using a private runner to run this workflow? It may be possible that the firewall rules on the runner are not allowing the action to download the tool. If you’re using GitHub hosted runners, then this shouldn’t be the problem.

Top Results From Across the Web

failed to download vulnerability DB in trivy 0.32.0+ · Issue #3146

I've been having trouble using trivy versions 0.32.0 and higher for several weeks. Trivy cli 0.32.0 and higher cannot seem to download the ......

Troubleshooting - Trivy - Aqua Security

Error downloading vulnerability DB. Error. FATAL failed to download vulnerability DB. If trivy is running behind corporate firewall try to whitelist urls below:....

Trivy Scan Always fails : failed to download vulnerability DB

I am trying to run a Trivy Scan from within CircleCI and always get the same problem. I keep disabling this, but clearly...

Failed to download vulnerability DB - Trivy by aquasecurity ...

[Solved]-Failed to download vulnerability DB - Trivy by aquasecurity-docker ... As ridiculous as it sounds. It turned out that my network was blocking...

Container vulnerability scanning with Trivy - Bluetab

Trivy is an open source tool focused on detecting vulnerabilities in OS-level ... 1/') - wget https://github.com/aquasecurity/trivy/releases/download/v${ ...