MPose (Community Member) asked a question.
We are trying to scan a .Net 5 API application using Azure DevOps task VeraCode@3 as described here: https://docs.veracode.com/r/Use_YAML_to_Add_Veracode_Analysis_to_Azure_DevOps_Pipelines
VeraCode shows under "Modules in Error" the main compiled EXE file with the message: "PDB Files Missing". The file listed as missing is:
workspace/_work/1/s/artifacts/obj/win-x64.Release/corehost/cli/apphost/standalone/Release/apphost.pdb
That file is not generated as part of the build artifacts, it seems to me it is part of the hosting environment and the application's class inherits from it/references it.
As a result the EXE is not selected as "EntryPoint" and the code is not scanned.
VeraCode lists .Net 5 as supported: https://docs.veracode.com/r/compilation_net
And since we're using the VeraCode pipeline integration I am not sure f there are any additional build steps or configurations in the project/solution applicable.
I read a previous answer on this which is over 2 years old and basically referred back to the documentation, which is not applicable in this case.
Thank you for any input!
.png){kind=logo}
Hello @mpose,
Thank you for reaching out to the Community.
The EXE file is built as part of the compilation if the project is set to produce a Console Application vs Library. This is typical because .NET allows you to build for self-contained deployment. If the app is meant to be a DLL, you should change the project property to output just the DLL or you can not upload the EXE to avoid the error.
Kind regards,
Steven
Veracode Support Engineer
Hello Steven,
thank you for the reply.
Our application is a "ASP.NET Core Web API" running on .NET5 (or .NET6 soon), which by design is marked as a "Console Application" because of how it's being hosted by IISExpress/Azure Application Services. So the EXE is created by default as part of the build process and I don't believe we can/should change that.
We are using the VeraCode Azure DevOps extension to Upload and scan the application (https://marketplace.visualstudio.com/items?itemName=Veracode.veracode-vsts-build-extension).
Would you suggest to exclude the EXE file using the "Optional Arguments" in the Task?
e.g. "-exclude *.exe" as documented here: https://docs.veracode.com/r/t_TFS_config_build_pipe
Thank you!
Michael
Hello @MPose (Community Member) ,
I would not even zip that EXE file in the upload to avoid any need to do optional parameters like exclude.
Best regards,
Steven
Veracode Support Engineer
Was this resolved? If so, how? I am having the same problem.
I'm on .NET 6.0 compiling with Visual Studio 2022.
My main compiled exe file shows a missing apphost.pdb, full expected path is /a/_work/1/s/artifacts/obj/win-x64.Release/corehost/apphost/standalone/apphost.pdb
Looking at the documentation, I should compile with this command:
C:\Program Files\Microsoft Visual Studio\2022\Professional\Msbuild\Current\Bin\MSBuild /p:OutDir=$(Build.ArtifactStagingDirectory)/buildOutput /tv:14.0 /t:Rebuild /p:Configuration=Debug /p:OutputPath=bin
I get warnings and errors; it will not successfully compile.
Warning NETSDK1182: Targeting .NET 6.0 in Visual Studio 2019 is not supported.
I get several more warnings like that one, and they are followed by:
Error NETSDK1004: Assets file 'E:\project.assets.json' not found. Run a NuGet package restore to generate this file.
And I already ran a restore, actually, earlier in my pipeline.
If I run the same build command, but without /tv:14.0 like this:
C:\Program Files\Microsoft Visual Studio\2022\Professional\Msbuild\Current\Bin\MSBuild /p:OutDir=$(Build.ArtifactStagingDirectory)/buildOutput /t:Rebuild /p:Configuration=Debug /p:OutputPath=bin
then it will compile, but that's when I get missing apphost.pdb on Veracode's static scan.
Has anyone solved this?
Hello rJacobsen,
the guidance we got from VeraCode was to exclude the generated .exe file from upload if you are building a .Net Core AppService. Basically the .exe file does not contain any custom code, it is just based on the original apphost.exe template file which gets a unique ID added and renamed to your {namespace.servicename}.exe
We are using Azure DevOps to upload and scan our services (https://docs.veracode.com/r/t_TFS_config_build_pipe).
I still think that is something VeraCode should address natively if .NET6 is officially listed as supported.
Hello @MPose (Community Member) ,
Thank you for responding to this post.
I would suggest adding this to the Ideas section within the Community. The more community supports an Idea, the more likely it will be considered or prioritized for implementation.
Kind regards,
Steven
Veracode Support Engineer