Fix/add retry to trivy

restore.yml

@@ -7,7 +7,7 @@ parameters:
 
 steps:
   - ${{if parameters.nuGetServiceConnections}}:
-    - task: NuGetAuthenticate@0
+    - task: NuGetAuthenticate@1
       inputs:
         nuGetServiceConnections: ${{ parameters.nuGetServiceConnections }}
 

scanBinaries.yml

@@ -21,29 +21,7 @@ jobs:
       destinationFolder: $(System.DefaultWorkingDirectory)/Binaries   
       cleanDestinationFolder: true
       overwriteExistingFiles: false
-  - script: | 
-      retries=10
-      count=0
-      while [ $count -lt $retries ]; do
-        log_output=$(docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -v /tmp:/tmp -v $(System.DefaultWorkingDirectory)/Binaries:/src aquasec/trivy:latest --exit-code 1 --format table --scanners vuln,misconfig,secret filesystem /src 2>&1)
-        result=$?
-        echo "$log_output"
-        if echo "$log_output" | grep -q "Fatal error	init error: DB error: failed to download vulnerability DB: database download error"; then
-          count=$((count + 1))
-          echo "Scan failed due to DB download error. Attempt $count/$retries. Retrying in 30 seconds..."
-          sleep 30
-        else
-          if [ $result -eq 0 ]; then
-            echo "Scan completed successfully."
-            break
-          else
-            echo "Scan failed due to other errors."
-            exit 1
-          fi
-        fi
-      done
-      if [ $count -eq $retries ]; then
-        echo "Scan failed after $retries attempts due to DB download error."
-        exit 1
-      fi
-    displayName: Scan compiled code with Trivy
+  - script: |
+      ./scan_with_retries.sh "docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -v /tmp:/tmp -v $(System.DefaultWorkingDirectory)/Binaries:/src aquasec/trivy:latest --exit-code 1 --format table --scanners vuln,misconfig,secret filesystem /src"
+    displayName: Scan compiled code with Trivy
+

scanCompiledArtifacts.yml

@@ -8,30 +8,6 @@ parameters:
   displayName: 'The directory to scan for vulnerabilities' 
 
 steps:
-- script: | 
-    retries=10
-    count=0
-    while [ $count -lt $retries ]; do
-      log_output=$(docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -v /tmp:/tmp -v ${{ parameters.directory }}:/src  aquasec/trivy:latest  --exit-code 1 --format table --scanners vuln,misconfig,secret filesystem /src 2>&1)
-      result=$?
-      echo "$log_output"
-      if echo "$log_output" | grep -q "Fatal error	init error: DB error: failed to download vulnerability DB: database download error"; then
-        count=$((count + 1))
-        echo "Scan failed due to DB download error. Attempt $count/$retries. Retrying in 30 seconds..."
-        sleep 30
-      else
-        if [ $result -eq 0 ]; then
-          echo "Scan completed successfully."
-          break
-        else
-          echo "Scan failed due to other errors."
-          exit 1
-        fi
-      fi
-    done
-    if [ $count -eq $retries ]; then
-      echo "Scan failed after $retries attempts due to DB download error."
-      exit 1
-    fi
-
-  displayName: Scan compiled code with Trivy
+  - script: |
+      ./scan_with_retries.sh "docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -v /tmp:/tmp -v ${{ parameters.directory }}:/src  aquasec/trivy:latest  --exit-code 1 --format table --scanners vuln,misconfig,secret filesystem /src"
+    displayName: Scan compiled code with Trivy

scanDockerImage.yml

@@ -30,40 +30,15 @@ jobs:
     inputs:
       command: login
       containerRegistry: ${{ parameters.dockerRegistryConnection }}
-  - task: Docker@0
+  - task: Bash@3
     displayName: 'Pull Docker image from private registry'
     inputs:
-      containerregistrytype: 'Container Registry'
-      dockerRegistryConnection: ${{ parameters.dockerRegistryConnection }}
-      action: 'Run a Docker command'
-      customCommand: 'pull ${{ parameters.dockerRegistryName }}/${{ parameters.dockerImageRepoName }}:${{ parameters.dockerImageRepoVersion }}'
+      targetType: inline
+      script: |
+        docker pull ${{ parameters.dockerRegistryName }}/${{ parameters.dockerImageRepoName }}:${{ parameters.dockerImageRepoVersion }}
 
-  - script: | 
-      retries=10
-      count=0
-      while [ $count -lt $retries ]; do
-        log_output=$(docker run --rm -v /var/run/docker.sock:/var/run/docker.sock  -v ${{ parameters.trivyIgnoreFile }}:/tmp/trivyignore aquasec/trivy:latest image --ignorefile /tmp/trivyignore --exit-code 1 --format table --scanners vuln,misconfig,secret  ${{ parameters.dockerRegistryName }}/${{ parameters.dockerImageRepoName }}:${{ parameters.dockerImageRepoVersion }} 2>&1)
-        result=$?
-        echo "$log_output"
-        if echo "$log_output" | grep -q "Fatal error	init error: DB error: failed to download vulnerability DB: database download error"; then
-          count=$((count + 1))
-          echo "Scan failed due to DB download error. Attempt $count/$retries. Retrying in 30 seconds..."
-          sleep 30
-        else
-          if [ $result -eq 0 ]; then
-            echo "Scan completed successfully."
-            break
-          else
-            echo "Scan failed due to other errors."
-            exit 1
-          fi
-        fi
-      done
-      if [ $count -eq $retries ]; then
-        echo "Scan failed after $retries attempts due to DB download error."
-        exit 1
-      fi
-
+  - script: |
+      ./scan_with_retries.sh "docker run --rm -v /var/run/docker.sock:/var/run/docker.sock  -v ${{ parameters.trivyIgnoreFile }}:/tmp/trivyignore aquasec/trivy:latest image --ignorefile /tmp/trivyignore --exit-code 1 --format table --scanners vuln,misconfig,secret  ${{ parameters.dockerRegistryName }}/${{ parameters.dockerImageRepoName }}:${{ parameters.dockerImageRepoVersion }}"
     displayName: Scan image with Trivy
 
 #  The Trivy task does not work yet.

scan_with_retries.sh

@@ -0,0 +1,31 @@
+#!/bin/bash
+
+command=$1
+retries=10
+count=0
+
+echo "Scan command: $command"
+echo "Starting scan with retries..."
+
+while [ $count -lt $retries ]; do
+  log_output=$($command 2>&1)
+  echo "$log_output"
+  if echo "$log_output" | grep "Fatal" | grep "failed to download artifact from any source" | grep -q "failed to download vulnerability DB"; then
+    count=$((count + 1))
+    echo "Scan failed due to DB download error. Attempt $count/$retries. Retrying in 30 seconds..."
+    sleep 30
+  else
+    if [ $? -eq 0 ]; then
+      echo "Scan completed successfully."
+      break
+    else
+      echo "Scan failed due to other errors."
+      exit 1
+    fi
+  fi
+done
+
+if [ $count -eq $retries ]; then
+  echo "Scan failed after $retries attempts due to DB download error."
+  exit 1
+fi