Failed to download policies from protected registry

[tom1299]

I installed the trivy-operator from the helm charts and want to download the policies from a protected registry. Therefore I changed the values according to the documentation:

policiesBundle:
  registry: "ghcr.io/cicdior"
  repository: aquasecurity/trivy-checks
  registryUser: "USERNAME-HERE"
  registryPassword: "PASSWORD-HERE"

But for some reason the download fails:

2024-11-25T14:44:11Z	ERROR	reconciler.scan job	Scan job container	{"job": "trivy-operator/scan-vulnerabilityreport-774c97c77c", "container": "4e9fde03-f97e-4ecd-b920-ee6607f247cc", "status.reason": "Error", "status.message": "2024-11-25T14:44:08Z\tINFO\tAdding schema version to the DB repository for backward compatibility\trepository=\"artifactory.devops.telekom.de/ghcr.io.docker/aquasec/trivy-db:2\"\n2024-11-25T14:44:08Z\tINFO\tNeed to update DB\n2024-11-25T14:44:08Z\tINFO\tDownloading DB...\trepository=\"artifactory.devops.telekom.de/ghcr.io.docker/aquasec/trivy-db:2\"\n2024-11-25T14:44:09Z\tFATAL\tFatal error\tinit error: DB error: failed to download vulnerability DB: database download error: OCI repository error: 2 errors occurred:\n\t* GET https://artifactory.devops.telekom.de/v2/ghcr.io.docker/aquasec/trivy-db/manifests/2: MANIFEST_UNKNOWN: The named manifest is not known to the registry.; map[manifest:aquasec/trivy-db]\n\t* GET https://artifactory.devops.telekom.de/v2/ghcr.io.docker/aquasec/trivy-db/manifests/2: UNAUTHORIZED: The client does not have permission for manifest: Download request for repo:path 'ghcr.io.docker-cache:aquasec/trivy-db/2/list.manifest.json' is forbidden for user: 'anonymous'.; map[manifest:aquasec/trivy-db]\n\n\n"}
github.com/aquasecurity/trivy-operator/pkg/vulnerabilityreport/controller.(*ScanJobController).completedContainers
	/home/runner/work/trivy-operator/trivy-operator/pkg/vulnerabilityreport/controller/scanjob.go:353
github.com/aquasecurity/trivy-operator/pkg/vulnerabilityreport/controller.(*ScanJobController).SetupWithManager.(*ScanJobController).reconcileJobs.func1
	/home/runner/work/trivy-operator/trivy-operator/pkg/vulnerabilityreport/controller/scanjob.go:80

I can however download the artefact with the same credentials with the oras oci registry client. For me it seems like username and password are not really used.

Thank you in advance for any help.

[tom1299]

So this was my fault. I used a wrong tag for the policy bundle oci image. Adding tag: 1 solved the problem