
ASamaraweera310648 (Community Member) asked a question.
Receiving error "There is 1 module with fatal error(s)
Module ID: '1473811570', Name: 'listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar'
Action 'beginScan' returned the following message: The analysis unit scan status is not valid for this action."
This is an empty jar file with the below description. Is veracode fails to accept this file because of the version number or no content?
https://github.com/google/guava/blob/master/futures/listenablefuture9999/pom.xml
An empty artifact that Guava depends on to signal that it is providing
ListenableFuture -- but is also available in a second "version" that
contains com.google.common.util.concurrent.ListenableFuture class, without
any other Guava classes. The idea is:
- If users want only ListenableFuture, they depend on listenablefuture-1.0.
- If users want all of Guava, they depend on guava, which, as of Guava
27.0, depends on
listenablefuture-9999.0-empty-to-avoid-conflict-with-guava. The 9999.0-...
version number is enough for some build systems (notably, Gradle) to select
that empty artifact over the "real" listenablefuture-1.0 -- avoiding a
conflict with the copy of ListenableFuture in guava itself. If users are
using an older version of Guava or a build system other than Gradle, they
may see class conflicts. If so, they can solve them by manually excluding
the listenablefuture artifact or manually forcing their build systems to
use 9999.0-....
.png)
Hello @ASamaraweera310648 (Community Member) ,
Thank you for reaching out to the Community.
The error message "No scannable binaries", if seen while trying to scan a language(JAR) that Veracode scans in binary form, means simply that the archive contains no binaries, or no binaries that are in a scannable state. May I ask that you confirm you followed the Packaging Guide https://docs.veracode.com/r/compilation_java
Kind regards,
Steven
Veracode Support Engineer
Excluded the artifact from the veracode, thanks.