Trivy 0.60.0 Fatal error: DB error: failed to download vulnerability DB

[ghs]

Description

I've created an issue #8575 but saw that it got automatically closed and for this reason writing it back here.

After switching to Trivy 0.60.0 in Azure DevOps pipeline with self-hosted agent we are unable to scan any image due the following error: "Fatal error: DB error: failed to download vulnerability DB"

Desired Behavior

The scan to download if needed any Trivy image, run and publish results successfully. Using 0.59.0 works perfectly fine with no issues at all.

Actual Behavior

Fatal error: DB error: failed to download vulnerability DB

The scan is stopped and exited with an error even though the task has been set with exitCode: 0

Reproduction Steps

1. Install https://marketplace.visualstudio.com/items?itemName=AquaSecurityOfficial.trivy-official
2. Use it with a self-hosted agent. Not sure if with MS agent happens the same.
3. Add trivy task to a pipeline and provide an image to scan.

The user from the agent which is used with the pipeline has full access to /tmp if this is from some help.

Target

Container Image

Scanner

Vulnerability

Output Format

None

Mode

None

Debug Output

2025-03-19T07:58:08.7510278Z Status: Downloaded newer image for aquasec/trivy:latest
2025-03-19T07:58:08.7510498Z 2025-03-19T07:58:06Z	INFO	[vulndb] Need to update DB
2025-03-19T07:58:08.7510739Z 2025-03-19T07:58:06Z	INFO	[vulndb] Downloading vulnerability DB...
2025-03-19T07:58:08.7511021Z 2025-03-19T07:58:06Z	INFO	[vulndb] Downloading artifact...	repo="mirror.gcr.io/aquasec/trivy-db:2"
2025-03-19T07:58:08.7511763Z 0 B / 61.14 MiB [___________________________________________________________________] 0.00% ? p/s 0s2025-03-19T07:58:07Z	FATAL	Fatal error	init error: DB error: failed to download vulnerability DB: OCI artifact error: failed to download vulnerability DB: failed to download artifact from mirror.gcr.io/aquasec/trivy-db:2: oci download error: failed to create a temp dir: mkdir /tmp/trivy3822596487: permission denied
2025-03-19T07:58:08.7519853Z ##[error]Failed: Trivy detected problems.
2025-03-19T07:58:08.7706527Z ##[error]Trivy seems to have failed so no output path to generate reports from.
2025-03-19T07:58:08.7711427Z Done!

Operating System

Ubuntu 22.04.5

Version

0.60.0

Checklist

• Run trivy clean --all
• Read the troubleshooting

[simar7]

The page at https://marketplace.visualstudio.com/items?itemName=AquaSecurityOfficial.trivy-official talks about self hosted runners.

cc @owenrumney

[ghs]

I know and as I mentioned, using 0.59.0 works perfectly but with the new one fails.
This is what we have currently:

- task: trivy@1
    inputs:
      exitCode: 0
      loginDockerConfig: true
      version: 0.59.0 <-- Had to set it otherwise using "latest" results in the error mentioned above
      image: ....