Version pinning?

[kdybicz]

Description

We're currently using Trivy in two slightly different Debian-based use cases, and I must say that this news was "a bit disturbing".

We want to be able to pin down the version of Trivy when installing it, but currently, afaik it's not (at least easily?) possible, as when a new version appears, the old one vanishes from APT.

Any suggestions on how to solve this problem?

Things that does't work
Note: Version 0.69.1 was chosen intentionally to prove pinning to past versions doesn't work

root@3adebc2e23a6:/# apt info trivy=0.69.3
Package: trivy
Version: 0.69.3
Priority: optional
Section:
Maintainer: Teppei Fukuda <knqyf263@gmail.com>
Installed-Size: 162 MB
Homepage: https://github.com/aquasecurity
Download-Size: 48.6 MB
APT-Sources: https://aquasecurity.github.io/trivy-repo/deb generic/main amd64 Packages
Description: A Fast Vulnerability Scanner for Containers

root@3adebc2e23a6:/# apt info trivy=0.69.1
Package: trivy
State: not a real package (virtual)
N: Version '0.69.1' for 'trivy' was not found
N: Version '0.69.1' for 'trivy' was not found
N: No packages found

root@3adebc2e23a6:/home/test# curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/v0.69.1/contrib/install.sh -o trivy.sh
root@3adebc2e23a6:/home/test# chmod +x trivy.sh
root@3adebc2e23a6:/home/test# ./trivy.sh -d v0.69.1
aquasecurity/trivy info checking GitHub for tag 'v0.69.1'
aquasecurity/trivy info found version: 0.69.1 for v0.69.1/Linux/64bit
aquasecurity/trivy debug downloading files into /tmp/tmp.zKvEH8KzoR
aquasecurity/trivy debug http_download https://get.trivy.dev/trivy?os=Linux&arch=64bit&version=0.69.1&type=tar.gz&client=install-script
aquasecurity/trivy debug http_download_curl received HTTP status 404

Target

None

Scanner

None

[nikpivkin]

Hi @kdybicz !

Thank you for the suggestion. We're thinking about storing multiple versions and are already working on the rpm repository.