--insecure flag has no effect when scanning images from ECR registry

[manveer94]

Description

When scanning an image hosted in AWS ECR using a proxy, I pass the --insecure flag to ignore certificate verification. However, the flag has no effect in this case, and the scan fails during the credentials retrieval step.

The failure occurs here:
ecr.go#L81

Looking at the code, it appears that the default HTTP client is being used, regardless of the --insecure flag. But when --insecure is set (registryOptions.Insecure == true), the HTTP client should be configured with InsecureSkipVerify: true in the TLS config to skip certificate verification.

Desired Behavior

When --insecure is set, the HTTP client used in ECR interactions should honor it by setting InsecureSkipVerify: true in the TLS config.

Actual Behavior

Failing with error unexpected status code 401 Unauthorized: Not Authorized

Reproduction Steps

1. Set up a proxy that intercepts HTTPS traffic to ECR.
2. Run a Trivy scan on an image in ECR using `--insecure`.
3. Observe that the scan fails during the `GetCredentials` step.

Target

Container Image

Scanner

Vulnerability

Output Format

None

Mode

Standalone

Debug Output

$trivy image 1234567890.dkr.ecr.us-east-1.amazonaws.com/alpine:3.10.1 --insecure --debug

2025-08-06T17:00:27+05:30	DEBUG	No plugins loaded
2025-08-06T17:00:27+05:30	DEBUG	Default config file "file_path=trivy.yaml" not found, using built in values
2025-08-06T17:00:27+05:30	DEBUG	Cache dir	dir="/Users/manveerrayat/Library/Caches/trivy"
2025-08-06T17:00:27+05:30	DEBUG	Cache dir	dir="/Users/manveerrayat/Library/Caches/trivy"
2025-08-06T17:00:27+05:30	DEBUG	Parsed severities	severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2025-08-06T17:00:27+05:30	DEBUG	Ignore statuses	statuses=[]
2025-08-06T17:00:27+05:30	DEBUG	DB update was skipped because the local DB is the latest
2025-08-06T17:00:27+05:30	DEBUG	DB info	schema=2 updated_at=2025-08-06T06:25:50.370296309Z next_update=2025-08-07T06:25:50.370296039Z downloaded_at=2025-08-06T11:21:15.137848Z
2025-08-06T17:00:27+05:30	DEBUG	[pkg] Package types	types=[os library]
2025-08-06T17:00:27+05:30	DEBUG	[pkg] Package relationships	relationships=[unknown root workspace direct indirect]
2025-08-06T17:00:27+05:30	INFO	[vuln] Vulnerability scanning is enabled
2025-08-06T17:00:27+05:30	INFO	[secret] Secret scanning is enabled
2025-08-06T17:00:27+05:30	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-08-06T17:00:27+05:30	INFO	[secret] Please see also https://trivy.dev/dev/docs/scanner/secret#recommendation for faster secret detection
2025-08-06T17:00:27+05:30	DEBUG	[notification] Running version check
2025-08-06T17:00:27+05:30	DEBUG	Initializing scan cache...	type="fs"
2025-08-06T17:00:27+05:30	DEBUG	[notification] Version check completed	latest_version="0.65.0"
2025-08-06T17:00:32+05:30	DEBUG	Credential error	err="failed to get authorization token: operation error ECR: GetAuthorizationToken, exceeded maximum number of attempts, 3, https response error StatusCode: 0, RequestID: , request send failed, Post \"https://api.ecr.us-east-1.amazonaws.com/\": tls: failed to verify certificate: x509: “ecr.us-east-1.amazonaws.com” certificate is not trusted"
2025-08-06T17:00:34+05:30	FATAL	Fatal error
  - run error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.Run
        /Users/manveerrayat/dev/aqua/projects/src/bitbucket.org/scalock/trivy-oss/pkg/commands/artifact/run.go:412
  - image scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.run
        /Users/manveerrayat/dev/aqua/projects/src/bitbucket.org/scalock/trivy-oss/pkg/commands/artifact/run.go:450
  - scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact
        /Users/manveerrayat/dev/aqua/projects/src/bitbucket.org/scalock/trivy-oss/pkg/commands/artifact/run.go:289
  - unable to initialize a scan service:
    github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scan
        /Users/manveerrayat/dev/aqua/projects/src/bitbucket.org/scalock/trivy-oss/pkg/commands/artifact/run.go:673
  - unable to initialize an image scan service:
    github.com/aquasecurity/trivy/pkg/commands/artifact.imageStandaloneScanService
        /Users/manveerrayat/dev/aqua/projects/src/bitbucket.org/scalock/trivy-oss/pkg/commands/artifact/scanner.go:16
  - unable to find the specified image "934027998561.dkr.ecr.us-east-1.amazonaws.com/alpine:3.10.1" in ["docker" "containerd" "podman" "remote"]:
    github.com/aquasecurity/trivy/pkg/fanal/image.NewContainerImage
        /Users/manveerrayat/dev/aqua/projects/src/bitbucket.org/scalock/trivy-oss/pkg/fanal/image/image.go:61
  - 4 errors occurred:
	* docker error: unable to inspect the image (934027998561.dkr.ecr.us-east-1.amazonaws.com/alpine:3.10.1): Error response from daemon: No such image: 934027998561.dkr.ecr.us-east-1.amazonaws.com/alpine:3.10.1
	* containerd error: containerd socket not found: /run/containerd/containerd.sock
	* podman error: unable to initialize Podman client: no podman socket found: stat podman/podman.sock: no such file or directory
	* remote error: GET https://934027998561.dkr.ecr.us-east-1.amazonaws.com/v2/alpine/manifests/3.10.1: unexpected status code 401 Unauthorized: Not Authorized

Operating System

macOS Sequoia 15.5

Version

Version: dev
Vulnerability DB:
  Version: 2
  UpdatedAt: 2025-08-06 06:25:50.370296309 +0000 UTC
  NextUpdate: 2025-08-07 06:25:50.370296039 +0000 UTC
  DownloadedAt: 2025-08-06 11:21:15.137848 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2025-05-12 02:46:40.669179331 +0000 UTC
  NextUpdate: 2025-05-15 02:46:40.66917914 +0000 UTC
  DownloadedAt: 2025-05-12 12:00:22.378632 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[manveer94]

I have created draft pull request for fixing this issue.
#9322

[nikpivkin]

Track #9323