TheSpinCycle (Community Member) asked a question.

October 7, 2020 at 12:06 AM
NPM SCA scans using ci.sh suddenly stopped working as of 9/29/2020.

We utilize the `curl -sSL https://download.sourceclear.com/ci.sh | SCAN_DIR='./<dir-to-scan>' SRCCLR_scan_collectors='npm' sh` command in a Jenkins pipeline to do our SCA for a number of projects. I've run it on an Ubuntu runner and inside the Node docker image with the same results.

 

As of 9/29, these scans no longer work. All other scans using the shell script still appear to be working. I've tested Gradle, DLL and Yarn scans.

 

I receive the following error: "com.sourceclear.agent.commands.ScanCommand ERROR Unable to scan and generate report: Java heap space"

 

Our JVM heap size is set to max out at 4 GBs. I updated that to 8 GBs, then again to 12 GBs and we're still hitting that same error. I'm guessing something has changed in the ci.sh script, but I'm unable to find any reference to this script online outside of some Veracode docs. A changelog for something we blindly assume works would be extremely beneficial for something like this I think.

 

At this point I intend to try to utilize a Docker image with the CLI installed to try and unblock our builds. But until I get that up and running, we're blocked on a good number of projects due to this issue.

 

Any guidance would be extremely helpful.

  • 4 answers
  • 922 views

  • Jason M., Veracode Support (Veracode)

    Hello @TheSpinCycle (Community Member)​ ,

     

    Increasing the heap size usually fixes this issue but if that is not working, you can use the parameter below and it uses much less resources and usually will post results :

    --skim-vms

     

    However, this will leave the vulnerable methods out, but for some customers, that is worth it to get fast results without increasing heap sizes.

     

    Jason

    Community Support Engineer

    Expand Post
    Selected as Best

  • Jason M., Veracode Support (Veracode)

    Hello @TheSpinCycle (Community Member)​ ,

     

    Increasing the heap size usually fixes this issue but if that is not working, you can use the parameter below and it uses much less resources and usually will post results :

    --skim-vms

     

    However, this will leave the vulnerable methods out, but for some customers, that is worth it to get fast results without increasing heap sizes.

     

    Jason

    Community Support Engineer

    Expand Post
    Selected as Best

    • TheSpinCycle (Community Member)

      Hey Jason,

       

      I tried this previously, but maybe I was providing the parameter incorrectly.

       

      When using the ci.sh script, where would I put the parameter? My current callout as listed above is:

       

      "curl -sSL https://download.sourceclear.com/ci.sh | SCAN_DIR='./<dir-to-scan>' SRCCLR_scan_collectors='npm' sh"

       

      Do I just put it in with the SCAN_DIR and SRCCLR_scan_collectors parameters?

      Expand Post

      • Jason M., Veracode Support (Veracode)

        Afternoon @TheSpinCycle (Community Member)​ ,

         

        If you have tried the methods I provided, I would encourage you to reach out to the Veracode Support team to further investigate this issue. To open a support case, navigate to the Help menu from the top navigation and select Contact Support.

         

        Jason

        Community Support Engineer

        Expand Post

      • TheSpinCycle (Community Member)

        Thanks for your responses.

         

        I finally figured out the formatting to properly skip vms. So we at least have the builds unblocked. I'll mess around with defining directories to ignore during vms in hopes I can still get some vulnerable method scanning in there.

Topics (1)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.