Trivy - The first run cannot skip downloading DB

[lassehastrup]

Describe the bug
We're using oxsecurity/megalinter:latest in our devOps pipeline.
Previously we've had issues with trivy with the error described below, as it seems to be a general issue from their side regarding "downloading DB".

It's important to state, that it's far from every time we encounter this issue. This might only be on 5% of our pipeline runs.

From my understanding, your team have made changes to the way trivy was downloaded by caching trivy in the docker image, so that it didn't have to download from trivy on every run.

** Error received **

[Trivy] Hit TOOMANYREQUESTS: try again
[Trivy] Hit TOOMANYREQUESTS 5 times: Run trivy with --skip-db-update and --skip-check-update
❌ Linted [REPOSITORY] files with [trivy]: Found 1 error(s) - (22.18s)

• Using [trivy v0.57.1] https://megalinter.io/8.3.0/descriptors/repository_trivy
• MegaLinter key: [REPOSITORY_TRIVY]
• Rules config: identified by [trivy]
• Commands:
  [trivy fs --scanners vuln,misconfig --exit-code 1 .]
  [trivy fs --scanners vuln,misconfig --exit-code 1 .]
  [trivy fs --scanners vuln,misconfig --exit-code 1 .]
  [trivy fs --scanners vuln,misconfig --exit-code 1 .]
  [trivy fs --scanners vuln,misconfig --exit-code 1 .]
  [trivy fs --scanners vuln,misconfig --exit-code 1 .]
  [trivy fs --scanners vuln,misconfig --exit-code 1 . --skip-db-update --skip-check-update]
  --Error detail:
  2024-12-17T19:07:10Z ERROR [vulndb] The first run cannot skip downloading DB
  2024-12-17T19:07:10Z FATAL Fatal error init error: DB error: database error: --skip-update cannot be specified on the first run

docker pull oxsecurity/megalinter:latest | docker run

[nvuillam]

@lassehastrup damn, they were supposed to have fixed the problem with a new mirror gcr.io :/

aquasecurity/trivy#7668

I wonder if the fact that we try to call trivy unsuccessfully just before makes the workaround fail... :/