Sitelet https://github.com/DataDog/datadog-agent/pull/55362
Skip to content

[Backport 7.83.x] pkg/util/trivy: bump Trivy fork to skip unreadable static paths - #55362

Open
0intro wants to merge 1 commit into
7.83.xfrom
djc/backport-7.83.x-sbom-unreadable-static-path
Open

[Backport 7.83.x] pkg/util/trivy: bump Trivy fork to skip unreadable static paths#55362
0intro wants to merge 1 commit into
7.83.xfrom
djc/backport-7.83.x-sbom-unreadable-static-path

Conversation

@0intro

@0intro 0intro commented Aug 25, 2026

Copy link
Copy Markdown
Member

A host scan enables the OS analyzers alone, and every one of them
declares the paths it reads, so Trivy walks one root per declared path
instead of traversing the filesystem. One of those paths is
root/buildinfo/content_manifests, where Red Hat images keep their
content sets. A package install runs the core Agent as dd-agent and
/root is 0700, so the stat of that path returns EACCES and the whole
scan failed:

Scan error: unable to marshal report to sbom format, err: unable to
scan rootfs, err: trivy scan failed: failed analysis: analyze with
static paths: analyze with traversal: failed to stat root
/root/buildinfo/content_manifests: permission denied

Hosts reported no packages at all while container images kept scanning,
since a containerized Agent runs as root. The fork now treats a declared
path it cannot read like an absent one and analyzes the rest.

The pin is the fork commit this branch already carried plus that one
change, so the analyzer deferral and the remote image fix that main took
with the same bump stay out of a patch release.

Backport of #55349.

@0intro
pkg/util/trivy: bump Trivy fork to skip unreadable static paths
ef05eb8 
A host scan enables the OS analyzers alone, and every one of them
declares the paths it reads, so Trivy walks one root per declared path
instead of traversing the filesystem. One of those paths is
root/buildinfo/content_manifests, where Red Hat images keep their
content sets. A package install runs the core Agent as dd-agent and
/root is 0700, so the stat of that path returns EACCES and the whole
scan failed:

    Scan error: unable to marshal report to sbom format, err: unable to
    scan rootfs, err: trivy scan failed: failed analysis: analyze with
    static paths: analyze with traversal: failed to stat root
    /root/buildinfo/content_manifests: permission denied

Hosts reported no packages at all while container images kept scanning,
since a containerized Agent runs as root. The fork now treats a declared
path it cannot read like an absent one and analyzes the rest.

The pin is the fork commit this branch already carried plus that one
change, so the analyzer deferral and the remote image fix that main took
with the same bump stay out of a patch release.

Backport of #55349.
@0intro 0intro added team/agent-cspm qa/done QA done before merge and regressions are covered by tests labels Aug 25, 2026
@dd-octo-sts dd-octo-sts Bot added the internal Identify a non-fork PR label Aug 25, 2026
@github-actions github-actions Bot added the short review PR is simple enough to be reviewed quickly label Aug 25, 2026
@datadog-official

This comment has been minimized.

Sign in to view
@dd-octo-sts

dd-octo-sts Bot commented Aug 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Files inventory check summary

File checks results against ancestor fd637e77:

Results for datadog-agent_7.83.0~rc.5.git.5.ef05eb8.pipeline.133012289-1_amd64.deb:

No change detected

Results for datadog-iot-agent_7.83.0~rc.5.git.5.ef05eb8.pipeline.133012289-1_amd64.deb:

No change detected

@cit-pr-commenter-54b7da

cit-pr-commenter-54b7da Bot commented Aug 25, 2026 •
edited
Loading

Copy link
Copy Markdown

Regression Detector

Regression Detector Results

Metrics dashboard
Target profiles
Job ID: 3505d391-3fb6-4f49-a66f-8d651fdebb16

Baseline: fd637e7
Comparison: ef05eb8
Diff

Optimization Goals: ✅ No significant changes detected

Fine details of change detection per experiment

perf experiment goal Δ mean % Δ mean % CI trials links
➖ quality_gate_security_no_fs_load memory utilization +0.18 [+0.04, +0.32] 1 Logs bounds checks dashboard
➖ quality_gate_idle_all_features memory utilization +0.11 [+0.07, +0.15] 1 Logs bounds checks dashboard
➖ quality_gate_security_mean_fs_load memory utilization -0.08 [-0.15, -0.00] 1 Logs bounds checks dashboard
➖ quality_gate_security_idle memory utilization -0.16 [-0.27, -0.06] 1 Logs bounds checks dashboard
➖ quality_gate_private_action_runner memory utilization -0.18 [-0.31, -0.06] 1 Logs bounds checks dashboard
➖ quality_gate_idle memory utilization -0.30 [-0.42, -0.18] 1 Logs bounds checks dashboard
➖ quality_gate_metrics_logs memory utilization -0.77 [-1.01, -0.52] 1 Logs bounds checks dashboard
➖ quality_gate_logs % cpu utilization -1.16 [-2.03, -0.30] 1 Logs bounds checks dashboard

Bounds Checks: ❌ Failed

perf experiment bounds_check_name replicates_passed observed_value links
✅ quality_gate_idle intake_connections 10/10 4 = 4 bounds checks dashboard
❌ quality_gate_idle memory_usage 0/10 172.91MiB > 154MiB bounds checks dashboard
✅ quality_gate_idle total_bytes_received 10/10 746.60KiB ≤ 819.20KiB bounds checks dashboard
✅ quality_gate_idle_all_features intake_connections 10/10 4 = 4 bounds checks dashboard
✅ quality_gate_idle_all_features memory_usage 10/10 511.58MiB ≤ 512MiB bounds checks dashboard
✅ quality_gate_idle_all_features total_bytes_received 10/10 1.14MiB ≤ 1.25MiB bounds checks dashboard
✅ quality_gate_logs intake_connections 10/10 4 ≤ 6 bounds checks dashboard
❌ quality_gate_logs memory_usage 1/10 208.15MiB > 195MiB bounds checks dashboard
✅ quality_gate_logs missed_bytes 10/10 0B = 0B bounds checks dashboard
✅ quality_gate_logs total_bytes_received 10/10 264.16MiB ≤ 292MiB bounds checks dashboard
✅ quality_gate_metrics_logs cpu_usage 10/10 354.26 ≤ 2000 bounds checks dashboard
✅ quality_gate_metrics_logs intake_connections 10/10 4 ≤ 6 bounds checks dashboard
✅ quality_gate_metrics_logs memory_usage 10/10 392.58MiB ≤ 430MiB bounds checks dashboard
✅ quality_gate_metrics_logs missed_bytes 10/10 0B = 0B bounds checks dashboard
✅ quality_gate_metrics_logs total_bytes_received 10/10 0.94GiB ≤ 1.04GiB bounds checks dashboard
✅ quality_gate_private_action_runner memory_usage 10/10 70.99MiB ≤ 75MiB bounds checks dashboard
✅ quality_gate_security_idle cpu_usage 10/10 27.90 ≤ 100 bounds checks dashboard
✅ quality_gate_security_idle memory_usage 10/10 325.33MiB ≤ 330MiB bounds checks dashboard
✅ quality_gate_security_mean_fs_load cpu_usage 10/10 59.61 ≤ 200 bounds checks dashboard
✅ quality_gate_security_mean_fs_load memory_usage 10/10 303.47MiB ≤ 310MiB bounds checks dashboard
✅ quality_gate_security_no_fs_load cpu_usage 10/10 20.44 ≤ 100 bounds checks dashboard
✅ quality_gate_security_no_fs_load memory_usage 10/10 308.75MiB ≤ 320MiB bounds checks dashboard

Explanation

Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%

Performance changes are noted in the perf column of each table:

  • ✅ = significantly better comparison variant performance
  • ❌ = significantly worse comparison variant performance
  • ➖ = no significant change in performance

A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".

For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:

  1. Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.

  2. Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.

  3. Its configuration does not mark it "erratic".

CI Pass/Fail Decision

❌ Failed. Some Quality Gates were violated.

  • quality_gate_security_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_security_idle, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_security_no_fs_load, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_security_no_fs_load, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_idle_all_features, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
  • quality_gate_idle_all_features, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_idle_all_features, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
  • quality_gate_security_mean_fs_load, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_security_mean_fs_load, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check memory_usage: 1/10 replicas passed. Failed 9 which is > 0. Gate FAILED.
  • quality_gate_idle, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_idle, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
  • quality_gate_idle, bounds check memory_usage: 0/10 replicas passed. Failed 10 which is > 0. Gate FAILED.
  • quality_gate_private_action_runner, bounds check memory_usage: 10/10 replicas passed. Gate passed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

internal Identify a non-fork PR qa/done QA done before merge and regressions are covered by tests short review PR is simple enough to be reviewed quickly team/agent-cspm

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@0intro