SKR528364 (Community Member) asked a question.
Upload and Scan with Veracode
------------------------------------------------------------------------
[Debug mode is on]
Can Fail Build?
true
Version information:
VeracodeJavaAPI v18.5.5.2 c1.8.0_212
HPI location:
tmp/jenkins/plugins/veracode-jenkins-plugin/WEB-INF/lib/veracode-jenkins-plugin.jar
Processing files in [remote] workspace:
D:/Jenkins/workspace/NestTrader_working_branch
Performing scan from [remote] workspace?
true
Invoking the following command in remote workspace:
$ java -jar D:\Jenkins\veracode-jenkins-plugin\VeracodeJavaAPI.jar -action UploadAndScan -vid 799f46e1989df7059392e1c719d1c9e1 -vkey ******** -appname Omnesys_NestTrader -createprofile true -teams omnesys.ntdev@thomsonreuters.com -criticality VeryHigh -version #326 -autoscan true -useragent "VeracodeJenkinsPlugin/18.11.5.8 (Jenkins/2.176.3.3; Java/1.8.0_212)"
VeracodeJavaAPI v19.11.6.0 c1.8.0_65
Parsing error(s):
-filepath is required for the selected action.
The following parameters are optional for the selected action:
-createsandbox -exclude
-format -include
-inputfilepath -logfilepath
-maxretrycount -pattern
-phost -ppassword
-pport -puser
-replacement -sandboxid
-sandboxname -scanallnonfataltoplevelmodules
-scantimeout -selected
-selectedpreviously -toplevel
[20.03.27 14:53:36] Invalid input
Error- Returned code from wrapper:1
.png){kind=logo}
Hi @SKR528364 (Community Member),
The API Wrapper documentation for the uploadandscan composite action can be found in the Help Centre here:https://help.veracode.com/r/r_uploadandscan.
It states that the argument -filepath is required. This is the Filepath or folderpath of the files you want to upload to the Veracode Platform for scanning. By default, Veracode uploads all the subdirectories and files of this filepath. Ensure you have prepared the files according to Veracode packaging guidance.
I can see the command invocation from your question did not appear to include this required parameter:
$ java -jar D:\Jenkins\veracode-jenkins-plugin\VeracodeJavaAPI.jar -action UploadAndScan -vid 799f4***9e1 -vkey ******** -appname Omnesys_NestTrader -createprofile true -teams omn***s.com -criticality VeryHigh -version #326 -autoscan true -useragent "VeracodeJenkinsPlugin/18.11.5.8 (Jenkins/2.176.3.3; Java/1.8.0_212)"
Are you able to specify this parameter and try again?
Thanks,
Anthony Fielding
Anthony, Now comes a new error. Please find the details below. Can you please help me with this error.
D:\Jenkins\workspace\NestTrader_working_branch\NestTrader_working_branch\tools\Microsoft.Sdc.Tasks\Microsoft.Sdc.Tasks.dll -useragent "VeracodeJenkinsPlugin/18.11.5.8 (Jenkins/2.176.3.3; Java/1.8.0_212)"
[20.04.01 10:57:36]
[20.04.01 10:57:36] Attempting to create a new application profile with name "Omnesys_NestTrader" and criticality "Very High".
[20.04.01 10:57:37]
[20.04.01 10:57:37] * Action "UploadAndScan" returned the following message:
[20.04.01 10:57:37] * Access denied.
[20.04.01 10:57:37]
[20.04.01 10:57:37]
[20.04.01 10:57:37] An app_id could not be located for application profile "Omn_Trader".
Error- Returned code from wrapper:2
Build step 'Upload and Scan with Veracode' marked build as failure
[BFA] Scanning build for known causes...
[BFA] No failure causes found
[BFA] Done. 0s
Started calculate disk usage of build
Finished Calculation of disk usage of build in 0 seconds
Started calculate disk usage of workspace
Finished Calculation of disk usage of workspace in 1 second
Extended Email Publisher is currently disabled in project settings
Finished: FAILURE
Regards
Sujoy
Hi Sujoy,
We have a Help Centre article on how to configure the Veracode Jenkins Plugin here: https://help.veracode.com/r/SR6Zbh48KDeo2rH~Guvpiw/_g4SYeBLZyLguunqgdUP2w. I recommend reviewing the steps in that guide to ensure your configuration is correct.
The error suggests there may be a problem with your API credentials or permissions for the API user. Another Help Centre article exists to guide you through the process of creating those API credentials. You can find that here: https://help.veracode.com/r/c_identity_gen_creds.
If you are still experiencing issues I would recommend you contact our technical support team. Here's how you can log a case:
Thanks,
Anthony Fielding
@Anthony Fielding (Veracode) I am running into the same issue a Sujoy, and neither of you actually addressed the -filename issue, except to say that it was missing and then Sujoy did something mysterious and fixed it.
How do we actually fix it? That command invocation is kicked off in Jenkins I assume by the Veracode plugin; after following the documentation for configuring the jenkins plugin found here https://docs.veracode.com/r/c_about_jenkins there is no -filename parameter listed. There IS an uploadIncludesPattern parameter... shouldn't the veracode plugin get that value and automatically place it in the invocation? There is no way I can see in Jenkins to edit that plugin such that the invocation includes that missing parameter. And the documentation doesn't describe anything about how to implement the wrappers for Jenkins. What am I missing?
Below is a copy/paste from the Jenkins output. I asterisked a bunch of our sensitive data out of the API wrapper.
------------------------------------------------------------------------
Upload and Scan with Veracode Pipeline
------------------------------------------------------------------------
[Debug mode is on]
Can Fail Job: true
Timeout: 10
Version information:
VeracodeJavaAPI v22.6.10.2 c1.8.0_144
HPI location:
C:/Jenkins/plugins/veracode-scan/WEB-INF/lib/veracode-scan.jar
Processing files in [local] workspace:
C:/Jenkins/workspace/WEBREG-958
Building arguments. Calling wrapper with arguments:
[-action, UploadAndScan, -vid, ********, -vkey, ********, -appname, ********, -createprofile, false, -teams, B****s, -criticality, VeryHigh, -version, *****-958, -autoscan, true, -deleteincompletescan, 0, -maxretrycount, 5, -debug, -useragent, VeracodeScanJenkins/22.6.18.0 (Jenkins/2.319.3; Java/1.8.0_144)]
VeracodeJavaAPI v22.6.10.2 c1.8.0_144
Parsing error(s):
-filepath is required for the selected action.
Hi @WLanni177481 (Community Member),
As per the error message, there was no -filepath argument passed in to the wrapper.
It sounds like you are using the Jenkins plugin so be sure to fill in the Upload field as per step 13 of this list of tasks: https://docs.veracode.com/r/t_configure_jenkins. Behind the scenes this maps onto -filepath when passed into the uploadandscan tool that does the actual work. The Jenkins integration is essentially a front-end UI to this tool.
If you are using scripts then consider setting the uploadIncludesPattern parameter as per https://docs.veracode.com/r/r_jenkins_pipeline_script_params. For example as highlighted below in a war file upload:
echo 'Veracode scanning'
withCredentials([ usernamePassword (
credentialsId: 'veracode_login', usernameVariable: 'VERACODE_API_ID', passwordVariable: 'VERACODE_API_KEY') ]) {
// wait for scan to complete (includes timeout parameter)
// veracode applicationName: "${VERACODE_APP_NAME}", criticality: 'VeryHigh', debug: true, timeout: 20, fileNamePattern: '', pHost: '', pPassword: '', pUser: '', replacementPattern: '', sandboxName: '', scanExcludesPattern: '', scanIncludesPattern: '', scanName: "${BUILD_TAG}", uploadExcludesPattern: '', uploadIncludesPattern: 'target/verademo.war', vid: '${VERACODE_API_ID}', vkey: '${VERACODE_API_KEY}'
}
If you are using the API wrapper directly (https://docs.veracode.com/r/r_uploadandscan) then be sure to specify the required -filepath argument. This is a filename or path name. If you supply a path name, then all files within will be uploaded to the scan.
I hope that helps.
Anthony