ncage (Community Member) asked a question.
So we are brand new to veracode. I have been tasked with adding veracode to our CI/CD pipeline (Azure DevOps pipeline). The first thing I noticed after adding the whitesource task was that i requires java (pipeline failed because of the java requirement)
We would much prefer to not add java to our build servers. I had the same type of issue when I added whitesource to our CI/CD pipeline. With whitesource i was able to download their agent (jar file) and run whitesource within a docker container on the build servers. Would I be able to do the same thing with veracode? (at this point we are only doing a static code analysis).
.png){kind=logo}
Hi @ncage (Community Member) ,
The Veracode Azure DevOps Extension for Azure DevOps requires java. If you do not want to install Java on the build servers you could consider:
Thank you,
Boy Baukema
As a follow up, we now have supported Docker containers that can help with this challenge. You can find them on our DockerHub page:
https://hub.docker.com/u/veracode
Are there any plans to distribute a similar container image for the "srcclr" CLI tool?
There's a blog post from long ago that says how to go about creating one yourself, but it would be much easier to use one that is guaranteed to be up to date.
Hi @ncage (Community Member) I'm the primary maintainer of easy_sast, the community provided docker container that @Tim J (Veracode PM) (Veracode) referred to. If you do happen to use our tool, we would love some feedback! It has been running in CI for some rather critical applications for quite some time now.