BLOB_UNKNOWN

[julien-michaud]

Description

Hello guys,

Still getting the error BLOB_UNKNOWN when trying to run trivy v0.58.1.

 trivy \
    fs . \
    --severity CRITICAL,HIGH \
    --ignore-unfixed \
    --scanners vuln,secret \
    --format sarif \
    --output trivy-results.sarif \
    --timeout 5m0s \
    --vuln-type library \
    --db-repository mirror.gcr.io/aquasec/trivy-db:2
  shell: /usr/bin/bash -e {0}
2025-01-09T12:50:56Z	WARN	'--vuln-type' is deprecated. Use '--pkg-types' instead.
2025-01-09T12:50:56Z	INFO	[vulndb] Need to update DB
2025-01-09T12:50:56Z	INFO	[vulndb] Downloading vulnerability DB...
2025-01-09T12:50:56Z	INFO	[vulndb] Downloading artifact...	repo="mirror.gcr.io/aquasec/trivy-db:2"
2025-01-09T12:50:56Z	ERROR	[vulndb] Failed to download artifact	repo="mirror.gcr.io/aquasec/trivy-db:2" err="oci download error: failed to fetch the layer: GET https://mirror.gcr.io/v2/aquasec/trivy-db/blobs/sha256:e4c503650a561614e08a54d21eb8a1e991f95474b54f2738432c37fcb0f79f4c: BLOB_UNKNOWN: Unknown blob: sha256:e4c503650a561614e08a54d21eb8a1e991f95474b54f2738432c37fcb0f79f4c"
2025-01-09T12:50:56Z	FATAL	Fatal error	init error: DB error: failed to download vulnerability DB: OCI artifact error: failed to download vulnerability DB: failed to download artifact from any source: 1 error occurred:
	* oci download error: failed to fetch the layer: GET https://mirror.gcr.io/v2/aquasec/trivy-db/blobs/sha256:e4c503650a561614e08a54d21eb8a1e991f95474b54f2738432c37fcb0f79f4c: BLOB_UNKNOWN: Unknown blob: sha256:e4c503650a561614e08a54d21eb8a1e991f95474b54f2738432c37fcb0f79f4c

Is my conf bad ?

Thanks !

Desired Behavior

no BLOB_UNKNOWN error

Actual Behavior

BLOB_UNKNOWN error

Reproduction Steps

run trivy

Target

Container Image

Scanner

Vulnerability

Output Format

SARIF

Mode

Standalone

Debug Output

/

Operating System

ubuntu 22

Version

0.58.1

Checklist

• Run trivy clean --all
• Read the troubleshooting

[simar7]

cc @DmitriyLewen

[DmitriyLewen]

Hello @julien-michaud
mirror.gcr.io occasionally returns BLOB_UNKNOWN error.
This is rare case and we don't know the reason for it.

We have added handling for this error (#8060) so that Trivy will check other repositories if it gets BLOB_UNKNOWN.

But you are using a single repository. That's why you see this error.

You can remove the --db-repository flag to use the default 2 repositories (mirror.gcr.io/aquasec/trivy-db:2 -> ghcr.io/aquasecurity/trivy-db:2).
Or you can add more repositories to this flag as you wish.

Regards, Dmitriy