Skip to content

Bump Trivy to 0.69.2 Antelope#2189

Merged
priteau merged 1 commit intostackhpc/2023.1from
bump-trivy-antelope
Mar 2, 2026
Merged

Bump Trivy to 0.69.2 Antelope#2189
priteau merged 1 commit intostackhpc/2023.1from
bump-trivy-antelope

Conversation

@seunghun1ee
Copy link
Member

Trivy had security incident on 1st March 2026 [1], resulting losing all GitHub Releases between 0.27.0-0.69.1.
They then restored the latest as 0.69.2

[1] aquasecurity/trivy#10265

(cherry picked from commit 9144c9f)

Trivy had security incident on 1st March 2026 [1], resulting losing all
GitHub Releases between 0.27.0-0.69.1.
They then restored the latest as 0.69.2

[1] aquasecurity/trivy#10265

(cherry picked from commit 9144c9f)
@seunghun1ee seunghun1ee self-assigned this Mar 2, 2026
@seunghun1ee seunghun1ee requested a review from a team as a code owner March 2, 2026 11:29
@seunghun1ee seunghun1ee added the antelope Targets the Antelope OpenStack release label Mar 2, 2026
@priteau priteau merged commit 712c3f8 into stackhpc/2023.1 Mar 2, 2026
12 checks passed
@priteau priteau deleted the bump-trivy-antelope branch March 2, 2026 11:33
Copy link
Contributor

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates the recommended Trivy version in the scan-images.sh script to v0.69.2. The change is correct and aligns with the reasons outlined in the description. I have provided one suggestion to improve the robustness of the script by enhancing the check for Trivy's installation. This will provide a better user experience by failing early with a clear error message if Trivy is not available.

Comment on lines 13 to 15
if ! trivy --version; then
echo 'Please install trivy: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v0.49.1'
echo 'Please install trivy: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v0.69.2'
fi
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The current check for trivy can be improved for robustness and better user experience.

  • If trivy is installed, trivy --version prints its output to stdout, which can be noisy.
  • If trivy is not installed, the script prints a message but continues, failing later on. This can be confusing for the user.
  • Diagnostic messages should be printed to stderr, not stdout.

The suggested change addresses these points by silencing the version check, exiting immediately if trivy is not found, and printing messages to stderr.

Suggested change
if ! trivy --version; then
echo 'Please install trivy: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v0.49.1'
echo 'Please install trivy: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v0.69.2'
fi
if ! trivy --version >/dev/null 2>&1; then
echo "Error: trivy not found. Please install v0.69.2:" >&2
echo 'curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v0.69.2' >&2
exit 1
fi

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

antelope Targets the Antelope OpenStack release

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants