VShanmugam973172 (Community Member) asked a question.

Getting "could not find any dependencies" during image scan

Getting the below error message during Veracode image scan . Scan is triggered thru jenkins pipeline

 

"Veracode SCA could not find any dependencies in **xxxxxxx** image; please check that it is of a supported distribution. For distributions using yum package manager, please also check that yum update is possible."

 

My docker file has below base image

FROM registry.access.redhat.com/ubi8/openjdk-11@sha256:6689b41798467aa747dcd193b542fb49f185e2a4ff88f6df6962462c18a8da42

 

Below is the script used to perform scan

script {

sh """

export SRCCLR_API_TOKEN='${TOKEN}'

curl -sSL https://download.sourceclear.com/ci.sh | sh -s scan --image "${imageRepo}:${BUILD_NUMBER}"

"""

}

 

Please help


  • THolz534114 (Community Member)

    The error message "could not find any dependencies" during an image scan typically occurs when a software tool or system is attempting to analyze or inspect a container image for its dependencies, but it can't find any dependencies to report. This can be caused by several factors, and troubleshooting may involve the following steps:

    1. Check Image Contents: Verify that the container image you are scanning actually contains software or dependencies. If the image is empty or does not include any software, you will receive this error.
    2. Use a Proper Scanning Tool: Ensure that you are using a container image scanning tool that is designed to identify and report on dependencies correctly. Different scanning tools may have varying levels of accuracy and capabilities.
    3. Image Configuration: Examine the configuration and metadata of the container image. Verify that it is correctly structured and includes information about its software components.
    4. Scan Options: Review the options and parameters you are using when running the image scan. Ensure that you are specifying the correct image name or path.
    5. Network Access: Some container image scanning tools require internet access to fetch additional information about dependencies. Make sure your scanning environment has internet connectivity and can access the necessary resources.
    6. Image Source: Confirm the source of the container image. If you are pulling images from a private registry, ensure that the registry is correctly configured and accessible.
    7. Tool Version: Ensure that you are using an up-to-date version of the container image scanning tool. Older versions may have limitations or issues that have been addressed in newer releases.
    8. Image Layer Analysis: Container images consist of multiple layers. Make sure that the scanning tool is capable of analyzing each layer for dependencies.

     

    The specific resolution may vary depending on the tool you are using and the context of your container image. If you could provide more details about the tool, container image, and the steps you are taking, I can offer more targeted guidance.

     

     

     

     

    Expand Post

Topics (5)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.