Release versions between v0.26.0 and v0.69.2 just disappeared from Github

[PenelopeFudd]

Description

We've pinned trivy v0.68.2 in our ansible install script, and today all deployments started failing:

# curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -x -b /usr/local/bin v0.68.2
....
+ curl -w %{http_code} -sL -o /tmp/tmp.UWxu5LUHil/trivy_0.68.2_Linux-64bit.tar.gz https://get.trivy.dev/trivy?os=Linux&arch=64bit&version=0.68.2&type=tar.gz&client=install-script
+ code=404

Desired Behavior

Expected the file to be there.

Actual Behavior

Got a 404 error instead.

Reproduction Steps

1. `curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -x -b /usr/local/bin v0.68.2`
2.
3.
...

Target

None

Scanner

None

Output Format

None

Mode

None

Debug Output

$ curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -x -b /usr/local/bin v0.68.2

+ getopts b:c:dh?x arg
+ BINDIR=/usr/local/bin
+ getopts b:c:dh?x arg
+ shift 3
+ TAG=v0.68.2
+ tag_to_version
+ [ -z v0.68.2 ]
+ log_info checking GitHub for tag 'v0.68.2'
+ log_priority 6
+ test -z 6
+ [ 6 -le 6 ]
+ log_prefix
+ echo aquasecurity/trivy
+ log_tag 6
+ echo info
+ echo aquasecurity/trivy info checking GitHub for tag 'v0.68.2'
aquasecurity/trivy info checking GitHub for tag 'v0.68.2'
+ github_release aquasecurity/trivy v0.68.2
+ owner_repo=aquasecurity/trivy
+ version=v0.68.2
+ test -z v0.68.2
+ giturl=https://github.com/aquasecurity/trivy/releases/v0.68.2
+ http_copy https://github.com/aquasecurity/trivy/releases/v0.68.2 Accept:application/json
+ mktemp
+ tmp=/tmp/tmp.95zmHy4RvT
+ http_download /tmp/tmp.95zmHy4RvT https://github.com/aquasecurity/trivy/releases/v0.68.2 Accept:application/json
+ log_debug http_download https://github.com/aquasecurity/trivy/releases/v0.68.2
+ log_priority 7
+ test -z 7
+ [ 7 -le 6 ]
+ return 0
+ is_command curl
+ command -v curl
+ http_download_curl /tmp/tmp.95zmHy4RvT https://github.com/aquasecurity/trivy/releases/v0.68.2 Accept:application/json
+ local_file=/tmp/tmp.95zmHy4RvT
+ source_url=https://github.com/aquasecurity/trivy/releases/v0.68.2
+ header=Accept:application/json
+ [ -z Accept:application/json ]
+ curl -w %{http_code} -sL -H Accept:application/json -o /tmp/tmp.95zmHy4RvT https://github.com/aquasecurity/trivy/releases/v0.68.2
+ code=200
+ [ 200 != 200 ]
+ return 0
+ return
+ cat /tmp/tmp.95zmHy4RvT
+ body={"id":null,"tag_name":"v0.68.2","update_url":"/aquasecurity/trivy/releases/tag/v0.68.2","update_authenticity_token":"NFDzQwOOrylKqIVvkhoNgr_bDM71cWiJ4A1pRmPa2Y-0neeWhdHyElDaKyGr-qU-9vKkv7YEY8DRfW0siWayQA","delete_url":"/aquasecurity/trivy/releases/tag/v0.68.2","delete_authenticity_token":"jle1ZG7SQKeaRhfmoSzU2ZybIBK-G6F4BUxlChyAh13YaOl9xIJhUledBQZTbIiLh6Y2UPJjXScNdAtN7z-Org","edit_url":"/aquasecurity/trivy/releases/edit/v0.68.2"}
+ rm -f /tmp/tmp.95zmHy4RvT
+ echo {"id":null,"tag_name":"v0.68.2","update_url":"/aquasecurity/trivy/releases/tag/v0.68.2","update_authenticity_token":"NFDzQwOOrylKqIVvkhoNgr_bDM71cWiJ4A1pRmPa2Y-0neeWhdHyElDaKyGr-qU-9vKkv7YEY8DRfW0siWayQA","delete_url":"/aquasecurity/trivy/releases/tag/v0.68.2","delete_authenticity_token":"jle1ZG7SQKeaRhfmoSzU2ZybIBK-G6F4BUxlChyAh13YaOl9xIJhUledBQZTbIiLh6Y2UPJjXScNdAtN7z-Org","edit_url":"/aquasecurity/trivy/releases/edit/v0.68.2"}
+ json={"id":null,"tag_name":"v0.68.2","update_url":"/aquasecurity/trivy/releases/tag/v0.68.2","update_authenticity_token":"NFDzQwOOrylKqIVvkhoNgr_bDM71cWiJ4A1pRmPa2Y-0neeWhdHyElDaKyGr-qU-9vKkv7YEY8DRfW0siWayQA","delete_url":"/aquasecurity/trivy/releases/tag/v0.68.2","delete_authenticity_token":"jle1ZG7SQKeaRhfmoSzU2ZybIBK-G6F4BUxlChyAh13YaOl9xIJhUledBQZTbIiLh6Y2UPJjXScNdAtN7z-Org","edit_url":"/aquasecurity/trivy/releases/edit/v0.68.2"}
+ test -z {"id":null,"tag_name":"v0.68.2","update_url":"/aquasecurity/trivy/releases/tag/v0.68.2","update_authenticity_token":"NFDzQwOOrylKqIVvkhoNgr_bDM71cWiJ4A1pRmPa2Y-0neeWhdHyElDaKyGr-qU-9vKkv7YEY8DRfW0siWayQA","delete_url":"/aquasecurity/trivy/releases/tag/v0.68.2","delete_authenticity_token":"jle1ZG7SQKeaRhfmoSzU2ZybIBK-G6F4BUxlChyAh13YaOl9xIJhUledBQZTbIiLh6Y2UPJjXScNdAtN7z-Org","edit_url":"/aquasecurity/trivy/releases/edit/v0.68.2"}
+ echo {"id":null,"tag_name":"v0.68.2","update_url":"/aquasecurity/trivy/releases/tag/v0.68.2","update_authenticity_token":"NFDzQwOOrylKqIVvkhoNgr_bDM71cWiJ4A1pRmPa2Y-0neeWhdHyElDaKyGr-qU-9vKkv7YEY8DRfW0siWayQA","delete_url":"/aquasecurity/trivy/releases/tag/v0.68.2","delete_authenticity_token":"jle1ZG7SQKeaRhfmoSzU2ZybIBK-G6F4BUxlChyAh13YaOl9xIJhUledBQZTbIiLh6Y2UPJjXScNdAtN7z-Org","edit_url":"/aquasecurity/trivy/releases/edit/v0.68.2"}
+ tr -s \n  
+ + sed s/".*//
sed s/.*"tag_name":"//
+ version=v0.68.2
+ test -z v0.68.2
+ echo v0.68.2
+ REALTAG=v0.68.2
+ true
+ test -z v0.68.2
+ TAG=v0.68.2
+ VERSION=0.68.2
+ adjust_format
+ true
+ adjust_os
+ OS=Linux
+ true
+ adjust_arch
+ ARCH=64bit
+ true
+ log_info found version: 0.68.2 for v0.68.2/Linux/64bit
+ log_priority 6
+ test -z 6
+ [ 6 -le 6 ]
+ log_prefix
+ echo aquasecurity/trivy
+ log_tag 6
+ echo info
+ echo aquasecurity/trivy info found version: 0.68.2 for v0.68.2/Linux/64bit
aquasecurity/trivy info found version: 0.68.2 for v0.68.2/Linux/64bit
+ NAME=trivy_0.68.2_Linux-64bit
+ TARBALL=trivy_0.68.2_Linux-64bit.tar.gz
+ TARBALL_URL=https://get.trivy.dev/trivy?os=Linux&arch=64bit&version=0.68.2&type=tar.gz&client=install-script
+ CHECKSUM=trivy_0.68.2_checksums.txt
+ CHECKSUM_URL=https://github.com/aquasecurity/trivy/releases/download/v0.68.2/trivy_0.68.2_checksums.txt
+ execute
+ mktemp -d
+ tmpdir=/tmp/tmp.UWxu5LUHil
+ log_debug downloading files into /tmp/tmp.UWxu5LUHil
+ log_priority 7
+ test -z 7
+ [ 7 -le 6 ]
+ return 0
+ http_download /tmp/tmp.UWxu5LUHil/trivy_0.68.2_Linux-64bit.tar.gz https://get.trivy.dev/trivy?os=Linux&arch=64bit&version=0.68.2&type=tar.gz&client=install-script
+ log_debug http_download https://get.trivy.dev/trivy?os=Linux&arch=64bit&version=0.68.2&type=tar.gz&client=install-script
+ log_priority 7
+ test -z 7
+ [ 7 -le 6 ]
+ return 0
+ is_command curl
+ command -v curl
+ http_download_curl /tmp/tmp.UWxu5LUHil/trivy_0.68.2_Linux-64bit.tar.gz https://get.trivy.dev/trivy?os=Linux&arch=64bit&version=0.68.2&type=tar.gz&client=install-script
+ local_file=/tmp/tmp.UWxu5LUHil/trivy_0.68.2_Linux-64bit.tar.gz
+ source_url=https://get.trivy.dev/trivy?os=Linux&arch=64bit&version=0.68.2&type=tar.gz&client=install-script
+ header=
+ [ -z  ]
+ curl -w %{http_code} -sL -o /tmp/tmp.UWxu5LUHil/trivy_0.68.2_Linux-64bit.tar.gz https://get.trivy.dev/trivy?os=Linux&arch=64bit&version=0.68.2&type=tar.gz&client=install-script
+ code=404
+ [ 404 != 200 ]
+ log_debug http_download_curl received HTTP status 404
+ log_priority 7
+ test -z 7
+ [ 7 -le 6 ]
+ return 0
+ return 1

Operating System

Ubuntu 22.04

Version

$ trivy --version
trivy: command not found

Checklist

• Run trivy clean --all
• Read the troubleshooting

[PenelopeFudd]

It would be nice if the script said "Version v0.68.2 not found, try v0.69.2".

[nikpivkin]

Hi @PenelopeFudd !

Please, read https://github.com/aquasecurity/trivy/discussions/10265

[warmfusion]

Ironically, the link to that discussion is now a 404.

Can be found here: https://web.archive.org/web/20260307200451/https://github.com/aquasecurity/trivy/discussions/10265

[nikpivkin]

Yes, unfortunately the hackers have deleted it.