[Artur Khantimirov (r2k1)]

What this PR does / why we need it:

Replace the stale MCR mirror path with the current MCR database repository. Keep GHCR and public ECR as fallbacks. Scanner versions and image-scan cache reuse remain unchanged.

- mcr.microsoft.com/mirror/ghcr/aquasecurity/trivy-db:2
+ mcr.microsoft.com/oss/v2/aquasecurity/trivy-db:2

Evidence

• Before: all five ACL scans in build 187194204 used the June 29 database. Direct archive inspection confirmed the old mirror's UpdatedAt=2026-06-29T13:59:42.600856471Z. Trivy accepts the first successful download without rejecting its age.
• After: verified the proposed MCR reference on October 23 (local time), downloaded its archive, checked its SHA-256 against the manifest, and read metadata.json: schema 2, UpdatedAt=2026-10-22T19:12:23.943296885Z, NextUpdate=2026-10-23T19:12:23.943296554Z. Layer: sha256:82b284315ed95860ecc6eb7bce47a720d90551d598762820a67900bdfa0a94fb.
• GHCR/ECR currently report UpdatedAt=2026-10-22T19:14:47.059491382Z. The MCR snapshot is about 2 minutes 23 seconds earlier, not byte-identical to upstream. It is a fresh October 22 database, not the stale June archive.
• shellspec --shell bash --format d spec/vhdbuilder/packer/trivy_scan_spec.sh — passed, 25 examples, on the revised configuration.
• ignored=$(sed -n '/^IGNORED="/,/^"$/p' .pipelines/scripts/verify_shell.sh | sed '1d;$d' | paste -sd, -); shellcheck --exclude="$ignored" vhdbuilder/packer/trivy-scan.sh — passed.
• shellcheck --shell=sh --include=SC3010,SC3014 vhdbuilder/packer/trivy-scan.sh — passed.
• bash -n vhdbuilder/packer/trivy-scan.sh and git diff --check — passed.

CI and scan evidence

• Latest head 5a295195cf is pushed and its signature is Verified. Fresh GitHub checks are running; they are not yet green.
• Build 187220066 tested the earlier GHCR-first commit 31c85988e0, not the new MCR-first commit. Its fresh database detected CVE-2026-111943 and other findings missing from the June database. Those results are not end-to-end validation of the revised MCR source.
• Earlier Go CI failed the pre-existing TestLivePatchingUsesVHDInsteadOfCustomData size check: 87404 encoded characters against a limit of 87380.
• go test ./pkg/agent -run '^TestLivePatchingUsesVHDInsteadOfCustomData$' -count=2 -v in isolated archives confirmed the cause: parent 1dd236944f passed twice at 86820; SSH-disable commit f3163c3013 (#9091) failed twice at 87988. This PR does not change or weaken the assertion.

Merge danger: two-way change, limited to Linux VHD scanning. MCR remains the primary registry; only its repository path changes. This does not add a database-age gate or fix the vulnerabilities detected by the refreshed database. Required CI is not yet green.

Which issue(s) this PR fixes:

N/A — discovered while checking VHD scan database freshness.

[github-actions]

Windows Unit Test Results

  3 files   18 suites   1m 3s ⏱️
563 tests 563 ✅ 0 💤 0 ❌
585 runs  585 ✅ 0 💤 0 ❌

Results for commit 5a29519.

♻️ This comment has been updated with latest results.

[Copilot]

🟢 Approval recommended

The single-line change preserves existing upstream sources and their order, with no blocking issues identified.

No open issues 🎉

What changed in this PR

Updates Linux VHD vulnerability scanning to use upstream Trivy databases instead of the stale MCR mirror.

Changes:

• Removes MCR from the database source list.
• Keeps GHCR first and public ECR as fallback, without changing scanner versions or image-scan cache reuse.

File	Description
vhdbuilder/​packer/​trivy-scan.sh	Removes the MCR mirror from Trivy database sources.

_{Review effort: Balanced}

[Nishchay (awesomenix)]

Yes—the upstream Trivy vulnerability database is rebuilt every 6 hours, and your MCR copy is currently fresh.

For  mcr.microsoft.com/oss/v2/aquasecurity/trivy-db:2 , the live manifest reports creation at October 22, 2026, 12:34 PM PDT ( 19:34:14 UTC )—about 2 hours 46 minutes old at your message time.

• Upstream schedule: Official build workflow runs every 6 hours.
• MCR refresh cadence: Not established by that workflow; MCR mirrors it separately. This timestamp confirms a recent artifact, not a guaranteed six-hour mirror schedule.
• Tag  2 : The database schema version, not a release number. Its contents change while the tag stays the same.

This is a vulnerability-database OCI artifact, rather than a runnable application container.

[Copilot]

🔵 Needs a closer look

Required CI is reported as pending, and end-to-end scanning has not yet validated the revised MCR-first configuration.

No open issues 🎉

_{Review effort: Balanced}

[github-actions]

Package	Line Rate	Health
test	0%	❌
windows	27%	❌
staging_cse_windows Package 1	65%	➖
debug	0%	❌
provisioningscripts	2%	❌
parts_windows Package 1	73%	➖
Summary	38% (1652 / 6834)	❌

[github-actions]

Package	Line Rate	Health
shellspec spec	29%	❌
Summary	29% (4591 / 16078)	❌