Bug: Trivy Scanning Broken in v12.2.4

[EdKingscote]

Harbor v2.12.4 appears to use Trivy adaptor v0.32.4 per

harbor/Makefile

Line 108 in 6b4981d

TRIVYADAPTERVERSION=v0.32.4

Trivy adaptor v0.32.4 uses Trivy v0.61.1 per
https://github.com/goharbor/harbor-scanner-trivy/blob/b5af6e41938407f71b0da882dbf2c180beb8e33f/Dockerfile#L2

And Trivy <v0.63.0 is now broken and needs to be more recent:
aquasecurity/trivy#9624
aquasecurity/trivy#9628

[EdKingscote]

Trivy have reverted their change for now, but probably worth discussion with them to determine if this can be closed or if there is work to do: aquasecurity/trivy#9624 (comment)

[Vad1mo]

Do I understand that correctly the trivy db schema changed and we would need to patch release 2.12, 1.13 (tbd) to trivy >0.63.0?

[reasonerjt]

I'll double check, but it seems that if you upgrade to v2.13.x or v2.14.x the problem will be fixed? Alternatively you can deploy trivy adapter outside of Harbor and configure it as an external scanner.

[EdKingscote]

It appears that the trivy team have backed out the change on their side for now, which should fix things on 2.12 as well, but for sure upgrading to Harbor v2.13.2 fixed things too due to the newer adaptor/scanner.

Any change is challenging, but patch releases are far easier to digest than minor or major releases for most organizations, although there is always a process to follow. Turning this problem around in just a few hours by doing an upgrade was a significant headache.

Given the nature of the trivy adapter being the default and therefore baked in to many harbor deployments in the field ensuring co-ordination between the teams to mitigate breaking changes being introduced across supported releases is the real concern to be addressed looking forward imho.