lucas.ferreira likes this.

  • lucas.ferreira (M3Corp)

    Hi @anthony.jones (Community Member)​ 

     

    If I understood correctly, you are using the self hosted agents. In that case, you can install the CLI SCA agents .

     

    Install agent

     

    Link for reference: Install the Veracode SCA CLI Agent | Veracode Docs

    1. In the Veracode Platform, select Scans & Analysis > Software Composition Analysis.
    2. Click the Agent-Based Scan tab.
    3. Select a workspace.
    4. Click Agents > Actions > Create.
    5. On the Set Up Scanner page, select the operating system (Linux) for your agent
    6. Follow the instructions based on chosen: curl, apt-get or apk.
    7. After activate your agent, you can use the CLI scanner, exemple: srcclr scan PATH_TO_YOUR_APP

     

     

     

    Expand Post

    • anthony.jones (Community Member)

      Yes we are using self hosted agents in a cluster, so we have about 8 pods running our builds.

      The pods are selected at random based on the availability.

      ​

      If I add a srcclr token to one of the pods by shelling into it, running srcclr activate and adding the token. I am unable to add the token to other pods.

      ​

      When the build pipeline runs on a pod that the token wasn't added to, SCA scan fails with the message.

      "There was a problem authenticating with Veracode SCA. Please double check your Veracode SCA agent credentials or the value of the env variable "SRCCLR_API_TOKEN""

      ​

      Note that I have added the SRCCLR_API_TOKEN as a variable on the pipeline

      Expand Post

      • lucas.ferreira (M3Corp)

        @anthony.jones (Community Member)​ Yes I see...

         

        Usually, to automate SCA, we use the following approach:

         

        1. We create a Workspace and inside of them, create an SRCCLR Agent token
        2. We save that token into a Environment Variable called SRCCLR_API_TOKEN that can be used every time
        3. And then, run the script and use that Environment Variable as authentication
        4. Script command: curl -sSL https://download.sourceclear.com/ci.sh | sh -s scan

         

        The idea is: run the script to scan with SCA agent, use that token saved on Environment Variable every time as needed without to care about token activation

         

        This is make sense?

         

         

        Expand Post

Topics (3)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.