not able to use the nexus yum proxy repo to trivy

[hjrrao]

Hi,
we have a nexus yum proxy repo pointing to https://aquasecurity.github.io/trivy-repo/rpm/releases/7/x86_64/
this is a part of a repository group in nexus.
On the nodes we are referencing that repo group in yum.repos.d files to install the packages.
This was working till last week.
from the last week, once the trivy was updated to 0.37, our yum install trivy command is not working and getting the error as in the image.
somehow the path v0.37.1 getting into the uri part . pls look at the attachment. any help is appreciated.

[michael-brown-22]

Looking at the primary.xml it appears that the format in the current commit has changed adding in a new xml:base parameter and href path.

Previous commit

[teemcode]

Still relevant issue in v0.38.3
This prevents us using a local repository mirror for Trivy, as seen with the Nexus example. Proxy mirror is needed for Trivy clients that do not have access to internet/github, for example.

[ranebull]

Need fix repo metadata format (without hardcode github url) for proxy via nexus.

[michael-brown-22]

@knqyf263 Would it be possible to get an update on this?

[knqyf263]

@afdesk Would you look into it?

[afdesk]

oh, sorry guys. i missed this thread.

[afdesk]

@michael-brown-22 can i ask you to test the solution?

I've built a demo rpm trivy repository and deployed it here https://trivy-repo-dev.github.io/
could you try it for your case? thanks

[michael-brown-22]

hey @afdesk I will reach out to @hjrrao to see if he can test and we will get back to you

[afdesk]

hey @afdesk I will reach out to @hjrrao to see if he can test and we will get back to you

thanks for your help

[hjrrao]

Hi, i have created a new yum proxy repo inside our nexus and pointed it to https://trivy-repo-dev.github.io/rpm/releases/7/x86_64/
I have added the repo file as below to /etc/yum.repos.d
cat trivy-proxy.repo
[trivyiproxy]
name=trivyproxy
baseurl=https://username:password@nexus.domain/repository/trivy-proxy-new/
gpgcheck=0

Then when i do a yum install it fails with below error
https://username:password@nexusdomain/repository/trivy-proxy-new/trivy_0.42.3_Linux-64bit.rpm: [Errno 14] HTTPS Error 404 - Not Found

but if i use a standalone yum repo as below , it works fine
cat trivy.repo
[trivy]
name=Trivy TEST repository
baseurl=https://trivy-repo-dev.github.io/rpm/releases/$releasever/$basearch/
gpgcheck=1
enabled=1
gpgkey=https://trivy-repo-dev.github.io/rpm/public.key

[afdesk]

@hjrrao
thanks a lot! I'll think over it better

[afdesk]

my thoughts are next:

before v0.37 the artifacts were stored in the same place with rpm metadata.
then we decided to use Github assets for downloading from rpm (like for brew).

your nexus instance can download the metadata, but can't find the artifact on github https://github.com/aquasecurity/trivy/releases/download/

[keerthi-teff]

Hello @afdesk,

We have the same issue with nexus proxy repo.

If I user baseurl=https://aquasecurity.github.io/trivy-repo/rpm/releases/8/x86_64/

the trivy latest package will get downloaded. But with proxy URL we are getting errors.

Can you look into issue #34

any fix for this issue.