trivy: Unexpected EOF errors while analyzing image layers
Description
Trivy image scans fail intermittently with unexpected EOF errors while analysing layers.
What did you expect to happen?
Scan should complete without errors.
What happened instead?
2023-03-10T00:53:13.273+0530 FATAL image scan error:
github.com/aquasecurity/trivy/pkg/commands/artifact.Run
/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:427
- scan error:
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact
/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:266
- scan failed:
github.com/aquasecurity/trivy/pkg/commands/artifact.scan
/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:669
- failed analysis:
github.com/aquasecurity/trivy/pkg/scanner.Scanner.ScanArtifact
/home/runner/work/trivy/trivy/pkg/scanner/scan.go:146
- analyze error:
github.com/aquasecurity/trivy/pkg/fanal/artifact/image.Artifact.Inspect
/home/runner/work/trivy/trivy/pkg/fanal/artifact/image/image.go:139
- failed to analyze layer (sha256:2e9407335169dd770c900a232ae640b6fcd78d799788770f865ad867ccd5ca35):
github.com/aquasecurity/trivy/pkg/fanal/artifact/image.Artifact.inspect.func1
/home/runner/work/trivy/trivy/pkg/fanal/artifact/image/image.go:242
- walk error:
github.com/aquasecurity/trivy/pkg/fanal/artifact/image.Artifact.inspectLayer
/home/runner/work/trivy/trivy/pkg/fanal/artifact/image/image.go:312
- failed to extract the archive:
github.com/aquasecurity/trivy/pkg/fanal/walker.LayerTar.Walk
/home/runner/work/trivy/trivy/pkg/fanal/walker/tar.go:48
- unexpected EOF
-
Output of run with -debug
:
Output of trivy -v
:
Version: 0.38.2
Vulnerability DB:
Version: 2
UpdatedAt: 2023-03-09 18:07:12.23041002 +0000 UTC
NextUpdate: 2023-03-10 00:07:12.23040942 +0000 UTC
DownloadedAt: 2023-03-09 18:26:20.593016 +0000 UTC
Additional details (base image name, container registry info…):
About this issue
- Original URL
- State: closed
- Created a year ago
- Comments: 15
Hi @DmitriyLewen , thank you for the reply. It turns out it was trying to scan a different composer.lock that was empty, which caused the issue. It’s all good now. Thanks again!
I’m scanning a Drupal application and getting the same error. Composer.json file is 443.31 KB. I’m using the version 0.40.0.