SPanwar152813 (Community Member) asked a question.
I am scanning pom.xml which we had created for only deploying the latest libraries to the artifact server and I want to scan that pom.xml in Veracode. I am able to initialize the scan but the results are null,
i had setup srcclr plugin in my pom.xml but when I am running a command like mvn clean deploy com.srcclr:srcclr-maven-plugin:scan via jenkins it is showing no results, can someone please help
.png){kind=logo}
Hello @SPanwar152813 (Community Member) ,
First I would confirm that the Jenkin's plugin is properly configured by reviewing the Compilation Guide for Jenkins/Hudson Shell in our Help Center. If that is working correctly, then I would need to take a look at the Jenkin's file to see if I could spot any issues.
Jason
Veracode Support Engineer
@SPanwar152813 (Community Member) ,
It has been a few days, so I wanted to check in to see if the issue you posted about has been resolved.
Jason
Veracode Support Engineer
In the interim, you can catch the 3rd party flaws using SCA analysis. Then find the non-vulnerable library. Open eclipse. Click dependency hierarchy.
But the issue here is we are using one pom.xml file which consists of all the dependencies used in other microservices, and I need to scan all the dependencies in Veracode without downloading any of them. is there any way I can scan all the dependencies present in pom.xml as there is a single file, not any project?