aquasec/trivy:latest Docker tag is single-arch (arm64 only) — should be multi-arch manifest list

[wouterdebie]

Description

The aquasec/trivy:latest Docker tag is published as a single-architecture manifest pointing only to linux/arm64. The versioned tag 0.69.3 correctly publishes a multi-arch manifest list (amd64, arm64, ppc64le, s390x). It appears the :latest tag was overwritten with just the arm64 image rather than the full manifest list.

Desired Behavior

aquasec/trivy:latest should be a multi-arch manifest list (like aquasec/trivy:0.69.3), so docker pull aquasec/trivy:latest resolves to the correct architecture on any platform.

Actual Behavior

:latest resolves to only the arm64 image. On amd64 hosts this silently pulls the wrong architecture, leading to exec format errors at runtime.

Reproduction Steps

1. docker manifest inspect aquasec/trivy:latest → returns a single manifest (application/vnd.docker.distribution.manifest.v2+json), not a manifest list
2. docker pull aquasec/trivy:latest && docker image inspect aquasec/trivy:latest | grep Architecture → "Architecture": "arm64"
3. Compare: docker manifest inspect aquasec/trivy:0.69.3 → returns a proper manifest list with amd64, arm64, ppc64le, s390x
4.The digest of :latest (sha256:532de2ce287f…) matches exactly the arm64 entry in the 0.69.3 manifest list

Target

Container Image

Scanner

None

Output Format

None

Mode

None

Debug Output

$ docker manifest inspect aquasec/trivy:latest
{
    "schemaVersion": 2,
    "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
    ...
}
# Single manifest, NOT a manifest list

$ docker image inspect aquasec/trivy:latest | grep Architecture
    "Architecture": "arm64"

$ docker manifest inspect aquasec/trivy:0.69.3
{
    "schemaVersion": 2,
    "mediaType": "application/vnd.docker.distribution.manifest.list.v2+json",
    "manifests": [
        { "platform": { "architecture": "amd64", "os": "linux" } },
        { "platform": { "architecture": "arm64", "os": "linux" } },
        { "platform": { "architecture": "ppc64le", "os": "linux" } },
        { "platform": { "architecture": "s390x", "os": "linux" } }
    ]
}
# Correct multi-arch manifest list

Operating System

Linux

Version

$ trivy --version
Version: 0.69.3

Checklist

• Run trivy clean --all
• Read the troubleshooting

[bored-engineer]

FYI this is almost certainly the result of a incomplete/quick clean-up following the compromise of 0.19.4, see also: #10420

[hi-artem]

100% - it is crazy Trivy got hacked back to back

[knqyf263]

This has been fixed. The latest tag now correctly points to the multi-arch manifest list (amd64, arm64, ppc64le, s390x), matching 0.69.3.

$ crane manifest docker.io/aquasec/trivy:latest
{
   "schemaVersion": 2,
   "mediaType": "application/vnd.docker.distribution.manifest.list.v2+json",
   "manifests": [
      {
         "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
         "digest": "sha256:7228e304ae0f610a1fad937baa463598cadac0c2ac4027cc68f3a8b997115689",
         "platform": { "architecture": "amd64", "os": "linux" }
      },
      {
         "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
         "digest": "sha256:532de2ce287f594fbfbd91853c6d0910517cc87b01501b73b358b3d31b4eb87c",
         "platform": { "architecture": "arm64", "os": "linux" }
      },
      {
         "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
         "digest": "sha256:3de26f1d2c6e205d2eeb4e89cb5406c9b522739aba39ca7ac6f3655a85bc1428",
         "platform": { "architecture": "ppc64le", "os": "linux" }
      },
      {
         "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
         "digest": "sha256:d9e31ba03445c752ee9cbae9d4074a618ea293811d1b418d5d68fa5226788721",
         "platform": { "architecture": "s390x", "os": "linux" }
      }
   ]
}

Thanks for reporting this.

[wouterdebie]

Thanks!

…

On Thu, Mar 19, 2026 at 10:35 PM Teppei Fukuda ***@***.***> wrote: This has been fixed. The latest tag now correctly points to the multi-arch manifest list (amd64, arm64, ppc64le, s390x), matching 0.69.3. $ crane manifest docker.io/aquasec/trivy:latest { "schemaVersion": 2, "mediaType": "application/vnd.docker.distribution.manifest.list.v2+json", "manifests": [ { "mediaType": "application/vnd.docker.distribution.manifest.v2+json", "digest": "sha256:7228e304ae0f610a1fad937baa463598cadac0c2ac4027cc68f3a8b997115689", "platform": { "architecture": "amd64", "os": "linux" } }, { "mediaType": "application/vnd.docker.distribution.manifest.v2+json", "digest": "sha256:532de2ce287f594fbfbd91853c6d0910517cc87b01501b73b358b3d31b4eb87c", "platform": { "architecture": "arm64", "os": "linux" } }, { "mediaType": "application/vnd.docker.distribution.manifest.v2+json", "digest": "sha256:3de26f1d2c6e205d2eeb4e89cb5406c9b522739aba39ca7ac6f3655a85bc1428", "platform": { "architecture": "ppc64le", "os": "linux" } }, { "mediaType": "application/vnd.docker.distribution.manifest.v2+json", "digest": "sha256:d9e31ba03445c752ee9cbae9d4074a618ea293811d1b418d5d68fa5226788721", "platform": { "architecture": "s390x", "os": "linux" } } ] } Thanks for reporting this. — Reply to this email directly, view it on GitHub <#10422?email_source=notifications&email_token=AABKABQMYHTYRQDYIHKYNA34RS37RA5CNFSNUABIM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63SDN5WW2ZLOOQXTCNRSGE4TANJZUZZGKYLTN5XKMYLVORUG64VFMV3GK3TUVRTG633UMVZF6Y3MNFRWW#discussioncomment-16219059>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AABKABRO7PMWLIGNWAU3FMT4RS37RAVCNFSM6AAAAACWYUOU32VHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTMMRRHEYDKOI> . You are receiving this because you authored the thread.Message ID: ***@***.***>