MEgermaier (Community Member) asked a question.
Hi Veracode community,
we are starting a new Python project in our (NodeJS focused) team and are struggling with the Veracode Policy and Sandbox Scan.
Basically we have a setup of some .py files and the requirements.txt including the dependencies (Flask, pandas and numpy) which is deployable and runs on our staging environment without any issues. Right now I upload anything over the analysiscenter.veracode.com webpage manually without the usage of our cicd pipeline.
When I upload the compressed zip file with the .py files and the requirements.txt, VeraCode ignores any dependencies and the requirements.txt but recognizes only the .py files. It is necessary for our internal compliance to have Veracode Policy Scans with dependencies included.
How can I get VeraCode to make a complete policy scan including the dependencies?
Thank you very much and best regards,
Marco
.png){kind=logo}
I found a ticket which seems to refer to the same problem from two years ago. The issue does not seem to be solved:
https://community.veracode.com/s/question/0D53400004h9gUYCAY/has-anyone-gotten-their-python-code-to-scan-and-report-flaws
Hello, @MEgermaier (Community Member) ,
Thank you for reaching out to the Community!
Can you help me understand a little bit more about what you're trying to achieve or what outcome you're expecting? In general, our approach is to scan the first-party code, and use SCA to analyze the 3rd party code. If you are looking to have your 3rd party code analyzed, you would need to follow the packaging requirements for Upload/Scan SCA (adding a pipfile.lock, as documented in our Help Center, https://help.veracode.com/r/compilation_python). Or, use the agent-based scanner.
help.veracode.com
Packaging Python Applications
Your Python applications must meet specific compilation requirements before you can submit them for scanning.
Fwi, we don’t use the requirements.txt file for U/S SCA because it does not always specify a specific version of a library, but rather can specify a range of possible versions.
If the information we’ve provided you has helped resolve your challenge (or answered your question), we would appreciate it if you could mark the response that was helpful with “Select as Best”. This will help other Community members who come across your question as a similar challenge they might be facing and your best answer will help them find the right solution as well.
I started working with Python. I've added requirements.txt and setup.py to my project. But, I am still confused about the purpose of both files. I have read that setup.py is designed for redistributable things and that requirements.txt is designed for non-redistributable things. But I am not certain this is accurate.
How are those two files truly intended to be used?
krogerfeed