TAhmed219057 (Community Member) asked a question.

March 24, 2020 at 4:58 AM
I was trying to integrate Veracode API in our Azure Build pipeline but it failed with error "Build Artifact Path is not valid" when Upload and Scan tasks performed

I have added Veracode upload and scan task in our Azure Build pipeline but it got failed saying "Build Artifact Path is not valid". Also, wanted to share one thing here, I was not uploading zip file hence I was trying to upload my complete project which has multiple solution files and dll's to Scan it. Is there any specific way to upload zip file that I can add in our build pipeline. Any help would be greatly appreciated? Thanks.

  • 4 answers
  • 1.93K views

  • Stephen J., Veracode Support (Veracode, Inc.)

    Hello @TAhmed219057 (Community Member)​ ,

    In Azure DevOps, you can both include modules for top-level scanning as well as exclude modules from top-level scanning using the "-include" and "-exclude" with the modules names in the Optional Arguments text field in the form:

    Configure a Build Pipeline Using the Azure DevOps and Visual Studio Team Foundation Server

    https://help.veracode.com/r/t_TFS_config_build_pipe

    Advanced Scan Settings:

    • If you are using a developer sandbox, enter a sandbox name or click Create Sandbox to create one.
    • In the Optional Arguments field, enter any optional parameters to apply to the Upload and Scan action. For example:
    • -include mymodule1.jar,mymodule2.jar,*.js -createsandbox true -sandboxname mysandbox

     

    Expand Post
    Selected as Best

  • Stephen J., Veracode Support (Veracode, Inc.)

    Hello @TAhmed219057 (Community Member)​ ,

    In Azure DevOps, you can both include modules for top-level scanning as well as exclude modules from top-level scanning using the "-include" and "-exclude" with the modules names in the Optional Arguments text field in the form:

    Configure a Build Pipeline Using the Azure DevOps and Visual Studio Team Foundation Server

    https://help.veracode.com/r/t_TFS_config_build_pipe

    Advanced Scan Settings:

    • If you are using a developer sandbox, enter a sandbox name or click Create Sandbox to create one.
    • In the Optional Arguments field, enter any optional parameters to apply to the Upload and Scan action. For example:
    • -include mymodule1.jar,mymodule2.jar,*.js -createsandbox true -sandboxname mysandbox

     

    Expand Post
    Selected as Best

      • TAhmed219057 (Community Member)

        Thank you @Stephen J., Veracode Support (Veracode, Inc.)​ , yes after I put -exclude followed by the third part dll;s and it worked.

         

        today I have initiated policy scan with API account from the azure pipeline. I have uploaded .zip file which contains all dll's and pdb files (debug mode) but when I see the scan status report in veracode portal it says pdb files were missing and Supporting Files Compiled without Debug Symbols. I compared from the folder which has all pdb files uploaded from the .zip package and none of the pdb files got uploaded. Can you please help me with this issue @Shuning, Veracode Community Manager (Veracode)​ ?

        I have added /p:DebugSymbols=true for my sokution and project files while building in pipeline, As I said above, when I compared from the packaged folder it has all pdb files inside that .zip file.

         

        PDB files Missing

        Expand Post

      • Stephen J., Veracode Support (Veracode, Inc.)

        Hello @TAhmed219057, your first party developed code when uploading the DLLs with the associated PDB files is necessary for the best scan results and to be able to associate line numbers in the results of flaws identified. Any third-party modules you are including in the upload may or may not have the associated PDB or debug symbol files if these are not available. However, those files are not required for the scan and an informational message only is displayed. We can confirm by looking at your application on the Veracode platform Review Modules tab to review which uploaded libraries specifically have these warnings with them if you open a support case and include the URL of the scan results. However, you should be able to determine this as well by reviewing if it is your first-party code with the warnings or is it third-party code?

         

        Compilation Instructions for .NET Languages

        https://help.veracode.com/reader/4EKhlLSMHm5jC8P8j3XccQ/UWyzuOKNbFbwQACRLkZVjA

        Packaging Guidance for .NET

        Applications must be packaged as EXE, DLL, or ZIP files.

        Veracode cannot analyze a 32-bit module that has 64-bit dependencies, or vice versa. If your application has this architecture, rebuild it to ensure that the parent module and its dependencies are all either 32-bit or 64-bit, but not mixed.

        Veracode requires debug symbols (PDB files) to be included with the application to accurately report the filenames and line numbers for findings.

        For web applications, Veracode requires the precompiled forms for your application. See Preparing .NET Web Applications for more guidance.

         

        If you would like to contact our technical support team. Here's how you can log a case:

        1. Navigate to the upper right corner of any page in the Community, click on your user avatar
        2. Select Contact Support from the drop-down menu

         

        Expand Post

Topics (6)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.