IStrathdee773527 (Community Member) asked a question.

August 6, 2020 at 5:28 PM
Veracode extension for Azure DevOps suddenly stopped giving output during "Upload & Scan" task

We have a client who was using the Veracode extension with Azure DevOps Server 2019 update 1.1 without issue in late July. Earlier this week, it was reported that the Upload & Scan task was only displaying the task info/description, but there is no actual Upload or Scanning performed.

The task itself completes successfully in the pipeline, but there's just no output.

 

I'm wondering what I should look for to resolve this. The client has stated that no changes to the pipeline were made since it last completed successfully with logs showing the output.

 

Here is what is currently displayed in the logs for that task once it completes:

2020-08-04T19:30:43.2367615Z ##sectionStarting: Upload and scan

2020-08-04T19:30:43.9399596Z ==============================================================================

2020-08-04T19:30:43.9399739Z Task : Veracode Upload and Scan

2020-08-04T19:30:43.9399788Z Description : Upload an application to the Veracode Platform for security testing.

2020-08-04T19:30:43.9399864Z Version : 3.1.0

2020-08-04T19:30:43.9399909Z Author : Veracode

2020-08-04T19:30:43.9399967Z Help : [Veracode](http://www.veracode.com)

2020-08-04T19:30:43.9400395Z ==============================================================================

2020-08-04T19:30:44.4893036Z ##sectionFinishing: Upload and scan

 

The previous step (Download Artifacts) completes successfully with output, and there is one warning (below are the last few lines of the output):

2020-08-04T19:30:43.2237211Z Download complete.

2020-08-04T19:30:43.2237452Z 7 placed file(s): 7 downloaded, 0 empty

2020-08-04T19:30:43.2237653Z 82 MB downloaded at 36938 KB/sec. Download time: 00:00:02.2536623.

2020-08-04T19:30:43.2237814Z Preparing to download artifact: build.SourceLabel

2020-08-04T19:30:43.2258580Z ##warningRelease management does not support download of artifact type GitRef in the current version

2020-08-04T19:30:43.2289781Z Downloaded linked artifact _Services-AdminPortal-CI

2020-08-04T19:30:43.2289923Z Finished artifacts download

2020-08-04T19:30:43.2336566Z ##sectionFinishing: Download Artifacts

 

It looks like we are one minor version behind (3.1 vs 3.2, latest), but I don't think that would cause this sudden behavior.

 

One option that was suggested was that the Veracode Upload & Scan task might fail if the same task is already running with the same credentials in another job, however that does not appear to be the case here either.

 

Thank you in advance!

  • 10 answers
  • 1.1K views

  • IStrathdee773527 (Community Member)

    Hi Stephen, thank you for your patience. After trying all the steps we were provided, the client determined it was due to their JAVA_HOME environmental variable being missing from the system. Once provided, the Veracode Upload & Scan task is now working as expected.

     

    Thank you for all the support here!

    Selected as Best

  • Stephen J., Veracode Support (Veracode, Inc.)

    Hello @IStrathdee773527 (Community Member)​ ,

    Thank you again for posting your question. To review, your question is why the Veracode Azure DevOps Extension uploadandscan task is only printing a header but not details of uploading an application for current scanning. Can you turn on "system.debug=true" and rerun the build step in order to see more details? The zipped log file would contain verbose and troubleshooting information. The other item to review is if the Veracode application has already had scans or sandbox scans run on it successfully previously. Occasionally if a scan fails, a follow-on scan may not succeed. There is a check-box in the Veracode Azure DevOps Extension uploadandscan build step that can toggle whether or not to fail the build if the uploadandscan fails. If it is not checked, then you will not get a failure indication depending on the results of the upload. We can assist in reviewing the log file for example if you email it to support@veracode.com.

     

    Expand Post

      • IStrathdee773527 (Community Member)

        Thank you Stephen! I have added the info you provided to our internal ticket and asked the team to perform those troubleshooting steps. Once they get back to me, I will definitely open a support ticket using the link you’ve provided below.

        Thanks for your help!

  • Stephen J., Veracode Support (Veracode, Inc.)

    Hello @IStrathdee773527 (Community Member)​ ,

    Thank you for the reply and helpful steps taken to open a support case and include the logs for review.

    One other recommendation would be that since this Release process shows a warning in preparing the artifacts for download, I checked the recent Microsoft forums for this type of problem and it was recommended there to confirm that the build step being used in their publish build artifacts build step, documented in the Microsoft Developer's site at, https://docs.microsoft.com/en-us/azure/devops/pipelines/tasks/utility/publish-build-artifacts?view=azure-devops.

     

    The issue in the included output you included was that there was a warning that in the Release pipeline, the artifacts could not be accessed.

     

    You can also share this with your colleagues. In addition, generating the zipped log files as we recommended to include the Veracode build step would also have more information on this Release warning, occurring before the Veracode build step. Please also add "system.debug = true" as the variable setting when running the Release pipeline.

     

    Expand Post

    • IStrathdee773527 (Community Member)

      Hi Stephen - thank you for the additional information. I have added it to the customer's ticket and am awaiting a response. As soon as I know more I will reply here and open up a support ticket if still necessary.

  • Stephen J., Veracode Support (Veracode, Inc.)

    Hello @IStrathdee773527 (Community Member)​ ,

    Thank you for the update on following up on the warning in a build step in the Azure DevOps pipeline. We recommend that you can still open a support case without supplying the debug enabled logs with the Veracode extension. The log file with "system.debug=true" is still needed, but we can start working with Engineering to help you resolve this as soon as the support case is created.

    Expand Post

  • IStrathdee773527 (Community Member)

    Hi Stephen, thank you for your patience. After trying all the steps we were provided, the client determined it was due to their JAVA_HOME environmental variable being missing from the system. Once provided, the Veracode Upload & Scan task is now working as expected.

     

    Thank you for all the support here!

    Selected as Best

Topics (4)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.