From 31c85988e0b87573324305e4bce5e8d2d7d921ef Mon Sep 17 00:00:00 2001 From: Artur Khantimirov Date: Fri, 23 Oct 2026 10:36:35 +1300 Subject: [PATCH 1/2] fix: use upstream Trivy vulnerability databases Remove the stale MCR mirror from the database source list. Keep GHCR as the first source and public ECR as the fallback. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9aaa7127-6cc0-4c70-830e-c4e04f9fa5bf --- vhdbuilder/packer/trivy-scan.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/vhdbuilder/packer/trivy-scan.sh b/vhdbuilder/packer/trivy-scan.sh index c28e5aa3a9c..284fd4e8b7c 100644 --- a/vhdbuilder/packer/trivy-scan.sh +++ b/vhdbuilder/packer/trivy-scan.sh @@ -6,7 +6,7 @@ TRIVY_REPORT_ROOTFS_JSON_PATH=${TRIVY_REPORT_DIRNAME}/trivy-report-rootfs.json TRIVY_REPORT_IMAGE_TABLE_PATH=${TRIVY_REPORT_DIRNAME}/trivy-report-images-table.txt CVE_DIFF_QUERY_OUTPUT_PATH=${TRIVY_REPORT_DIRNAME}/cve-diff.txt CVE_LIST_QUERY_OUTPUT_PATH=${TRIVY_REPORT_DIRNAME}/cve-list.txt -TRIVY_DB_REPOSITORIES="mcr.microsoft.com/mirror/ghcr/aquasecurity/trivy-db:2,ghcr.io/aquasecurity/trivy-db:2,public.ecr.aws/aquasecurity/trivy-db" +TRIVY_DB_REPOSITORIES="ghcr.io/aquasecurity/trivy-db:2,public.ecr.aws/aquasecurity/trivy-db" # renovate: datasource=rpm depName=trivy registryUrl=https://packages.microsoft.com/azurelinux/3.0/prod/cloud-native/x86_64/repodata TRIVY_PMC_VERSION="0.74.0" From 5a295195cf16aa302a787d4b418f88f201f79606 Mon Sep 17 00:00:00 2001 From: Artur Khantimirov Date: Fri, 23 Oct 2026 11:29:08 +1300 Subject: [PATCH 2/2] fix: use current MCR Trivy database repository Replace the retired mirror path with oss/v2/aquasecurity/trivy-db. Verified its archive metadata is from October 22; retain GHCR and ECR fallbacks. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9aaa7127-6cc0-4c70-830e-c4e04f9fa5bf --- vhdbuilder/packer/trivy-scan.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/vhdbuilder/packer/trivy-scan.sh b/vhdbuilder/packer/trivy-scan.sh index 284fd4e8b7c..e7dd54563c1 100644 --- a/vhdbuilder/packer/trivy-scan.sh +++ b/vhdbuilder/packer/trivy-scan.sh @@ -6,7 +6,7 @@ TRIVY_REPORT_ROOTFS_JSON_PATH=${TRIVY_REPORT_DIRNAME}/trivy-report-rootfs.json TRIVY_REPORT_IMAGE_TABLE_PATH=${TRIVY_REPORT_DIRNAME}/trivy-report-images-table.txt CVE_DIFF_QUERY_OUTPUT_PATH=${TRIVY_REPORT_DIRNAME}/cve-diff.txt CVE_LIST_QUERY_OUTPUT_PATH=${TRIVY_REPORT_DIRNAME}/cve-list.txt -TRIVY_DB_REPOSITORIES="ghcr.io/aquasecurity/trivy-db:2,public.ecr.aws/aquasecurity/trivy-db" +TRIVY_DB_REPOSITORIES="mcr.microsoft.com/oss/v2/aquasecurity/trivy-db:2,ghcr.io/aquasecurity/trivy-db:2,public.ecr.aws/aquasecurity/trivy-db" # renovate: datasource=rpm depName=trivy registryUrl=https://packages.microsoft.com/azurelinux/3.0/prod/cloud-native/x86_64/repodata TRIVY_PMC_VERSION="0.74.0"