Skip to content

fix(vex): handle 304 status code#10307

Open
alegrey91 wants to merge 1 commit intoaquasecurity:mainfrom
alegrey91:fix/handle-etag-status-code
Open

fix(vex): handle 304 status code#10307
alegrey91 wants to merge 1 commit intoaquasecurity:mainfrom
alegrey91:fix/handle-etag-status-code

Conversation

@alegrey91
Copy link
Contributor

@alegrey91 alegrey91 commented Mar 3, 2026

Description

Currently, trivy deletes the content of the vex cache every time a new download happens.
This action is not always needed, since when an ETag is provided, the server may respond with 304 Not Modified, meaning the existing content at dst is still valid.
In that case, trivy should not destroy dst. Instead, we can move it aside as a backup and restore it on 304.
This particular case happens when a Vexhub repository has a small ' update_interval '.
Here's the original PR where we noticed the bug: kubewarden/sbomscanner#867
cc @fabriziosestito

Related issues

There's no open issue for it.

Remove this section if you don't have related PRs.

Checklist

  • I've read the guidelines for contributing to this repository.
  • I've followed the conventions in the PR title.
  • I've added tests that prove my fix is effective or that my feature works.
  • I've updated the documentation with the relevant information (if needed).
  • I've added usage information (if the PR introduces new options)
  • I've included a "before" and "after" example to the description (if the PR is a user interface change).

@alegrey91 alegrey91 changed the title fix(pkg/downloader): handle 304 status code fix(downloader): handle 304 status code Mar 3, 2026
@alegrey91 alegrey91 changed the title fix(downloader): handle 304 status code fix(vex): handle 304 status code Mar 3, 2026
@alegrey91 alegrey91 force-pushed the fix/handle-etag-status-code branch 2 times, most recently from e2637f6 to 486981c Compare March 3, 2026 14:31
@alegrey91 alegrey91 marked this pull request as ready for review March 3, 2026 15:00
@alegrey91 alegrey91 requested a review from knqyf263 as a code owner March 3, 2026 15:00
Co-authored-by: Fabrizio Sestito <[email protected]>
Signed-off-by: Alessio Greggi <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant