SO'Brien168874 (Community Member) asked a question.

February 7, 2022 at 10:05 PM
For GO application scanning, is vendoring required?

We recently moved away from vendoring and starting using Artifactory as our GO module repo/mirror.  So that means that we don't have a 'vendor' directory to scan. Does the command line scanner only look at go.mod/go.sum and the build folder if there isn't a vendor folder?

  • 8 answers
  • 612 views

  • Jason M., Veracode Support (Veracode)

    Hello @SO'Brien168874 (Community Member)​ ,

     

    To answer your question, the vendor folder is needed for Static Analysis scans and not Software Composition Analysis scans. The SCA scans already look at go.sum file.

     

    Jason

    Veracode Support Engineer

    Expand Post

  • SO'Brien168874 (Community Member)

    Jason,

     

    Thank you for the response. Is Software Composition Analysis run from the agent (srcclr scan)?

     

    Thanks,

    Shaun

    Expand Post

    • Jason M., Veracode Support (Veracode)

      Hi @SO'Brien168874 (Community Member)​ ,

       

      In order to better answer your question, can you please let me know what you are trying to accomplish and expand upon more upon the previous question about SCA?

       

      Jason

      Veracode Support Engineer

      Expand Post

      • SO'Brien168874 (Community Member)

        Jason,

         

        We recently moved to using Artifactory as our source of truth for GO dependencies, i.e. no longer have a vendor folder. However, our security team scanned the source code (with SourceClear SCA) locally to identify security vulnerabilities. Now I am trying to mitigate the issues but continuously keep getting the same vulnerabilities back. The only way I could find to mitigate was to use the replace directive in go.mod to override vulnerable versions. Is that something you typically see from your customers?

         

        Our security team has been scanning like this:

         

        srcclr scan --allow-dirty --no-upload --ws=A77HvKw --recursive

         

        Should we be using the --quick option?

         

        Thanks,

        Shaun

        Expand Post

      • Jason M., Veracode Support (Veracode)

        Hello Shaun,

         

        I am researching the information you provided above and hope to have a response for you soon.

         

        Jason

        Veracode Support Engineer

        Expand Post

      • SO'Brien168874 (Community Member)

        Thanks Jason. My questions have been related to running SourceClear locally, however what can be done to automate the SCA process? We use Artifactory.

      • Jason M., Veracode Support (Veracode)

        Hi @SO'Brien168874 (Community Member)​ ,

         

        To debug issues with upload and scan, you could try to run the agent in a manner that emulates the behavior of the upload and scan but please note that this emulation only mimics the behavior of upload and scan scanning, and the behavior may be different wrt. the archive files found within the binary. To accomplish this:

         

        1. Unzip the binary into a folder, say project-dir.
        2. Scan the project-dir: SRCCLR_NO_GIT=1 SRCCLR_NPM_SCOPE=production SRCCLR_NODE_MODULES=true SRCCLR_FAT_JAR=true SRCCLR_BOWER_COMPONENTS=true SRCCLR_NO_DEPENDENCY_GRAPH=true SRCCLR_IGNORED_DLL_DIRS="node_modules" SRCCLR_IGNORED_JAR_DIRS="" srcclr scan --recursive --quick --debug project-dir

         

        Also, it is possible to automate the SCA, and would read the Help Center article Veracode SCA Best Practices for Automated CI/CD for more information.

         

        Jason

        Veracode Support Engineer

         

        Expand Post

Topics (3)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.