A.Digulla (Community Member) asked a question.

July 1, 2021 at 9:01 AM
Best practice to merge all pipeline scan results of a multi module Maven Reactor build

I have a project that contains up to 400 Maven modules and I'd like a single results file from the pipeline scan. It's not possible to scan more than a single file per invocation of pipeline-scan.jar (you can specify several files but only one of them will be scanned).

 

Even if I could pass more than one file, 400 files would exceed the maximum length of the command line, even on Linux.

 

Is there a way to merge pipeline scan results?

  • 5 answers
  • 745 views

  • Steven D., Veracode Support (Veracode)

    Hello @A.Digulla (Community Member)​ ,

     

    Thank you for reaching out to the Community.

     

    By Maven modules are you referring to your code?

    If you are, and assuming that it is first party code, you could just zip up the Jar files and pass that single zip file to the pipeline scan if it doesn't exceed the size limitation. Saying hat, this some what defeats the purpose or design of the Pipeline scan. If you are wanting an aggregated scan and results. you should be doing a platform scan.

     

    You can refer to a scan type in the link below.

    https://help.veracode.com/r/kJC1iOtXp8N~rCtV8P9jhw/tUytgFlTyj00mxCNIYKrtQ.

     

    Best regards,

    Steven

    Veracode Support Engineer

     

     

    Expand Post
    Selected as Best

  • Steven D., Veracode Support (Veracode)

    Hello @A.Digulla (Community Member)​ ,

     

    Thank you for reaching out to the Community.

     

    By Maven modules are you referring to your code?

    If you are, and assuming that it is first party code, you could just zip up the Jar files and pass that single zip file to the pipeline scan if it doesn't exceed the size limitation. Saying hat, this some what defeats the purpose or design of the Pipeline scan. If you are wanting an aggregated scan and results. you should be doing a platform scan.

     

    You can refer to a scan type in the link below.

    https://help.veracode.com/r/kJC1iOtXp8N~rCtV8P9jhw/tUytgFlTyj00mxCNIYKrtQ.

     

    Best regards,

    Steven

    Veracode Support Engineer

     

     

    Expand Post
    Selected as Best

  • BDaniel172425 (Community Member)

    Thank you for updating us with the outcome.

  • A.Digulla (Community Member)

    HI Steven,

     

    The link to help.veracode.com you provided is broken.

     

    I'll try the ZIP approach. VeraCode will then scan every piece of code in these files and not look for what it considers an entry point, correct?

     

    Because my suspicion is that the platform scan simply ignores 90% of our code because it can't see what I consider an entry point (but I have another question open for that).

    Expand Post

  • A.Digulla (Community Member)

    Hi Steven,

     

    Update: Creating a ZIP archive doesn't work. The pipeline scan will just pick the one JAR in the archive (in my tests, it was the last one added) and ignore the rest.

     

    Platform scan doesn't work for me because a) I can't trigger it from Jenkins/Maven and b) I also would like scans for my libraries *before* I include them into the product and get a huge muddled report for many unrelated issues.

    Expand Post

  • A.Digulla (Community Member)

    Update: Uploading a ZIP archive with all JARs works. The confusion came from the fact that the JSON report ("modules") doesn't list the files which were scanned but only those in which issues were found.

Topics (3)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.