AcesHigh (Community Member) asked a question.
I am trying to use the gradle plugin to scan a project. When I run ./gradlew srcclr, it appears to attempt to run the scan with no errors, but finds zero dependencies. I have the srcclr block as follows:
srcclr {
apiToken = "MY_TOKEN_HERE"
scope = "runtime"
shouldUpload = "false"
}
Output is:
Task :srcclrEvidence
[srcclr] Generating dependency graph for XYZ...
[srcclr] Generated dependency graphs for 0 modules
[srcclr] Created 0 pieces of evidence
> Task :srcclr
Summary Report
Scan ID SCAN_ID
Scan Date & Time Feb 29 2024 11:14AM CST
Account type ENTERPRISE
Scan engine 3.1.12 (latest Unknown)
Analysis time 0 seconds
User USER_ID
Project PROJECT_PATH
Package Manager(s)
Open-Source Libraries
Total Libraries 0
Direct Libraries 0
Transitive Libraries 0
Vulnerable Libraries 0
Third Party Code 0%
Security
With Vulnerable Methods 0
High Risk Vulnerabilities 0
Medium Risk Vulnerabilities 0
Low Risk Vulnerabilities 0
Licenses
Unique Library Licenses 0
Libraries Using GPL 0
Libraries With High Risk License 0
Libraries With Medium Risk License 0
Libraries With Low Risk License 0
Libraries With Multiple Licenses 0
Libraries With Unassessable License 0
Libraries With Unrecognizable License 0
Full Report Details REPORT_PATH
.png){kind=logo}
I found the issue. The documentation at Gradle Plugins Configuration is incorrect. When I set the scope to "runtime," no dependencies are found. When I change the scope to "runtimeClasspath," it finds all of the dependencies.
scope = "runtimeClasspath"
I think this could be due to a few reasons:
Configuration Issue: Check if the dependencies are properly configured in your Gradle build file (build.gradle). Ensure that the dependencies are declared in the correct scope and format.
You can also check this : https://docs.veracode.com/r/Gradle_Plugin_Configurations
Network Connectivity: Ensure that your network connection is stable and allows Gradle to access the necessary repositories to download dependencies. Sometimes, firewall settings or proxy configurations can block Gradle's access to dependency repositories.
API Token: Double-check if the API token provided in the srcclr block is correct and has the necessary permissions to access the dependencies. Make sure there are no typos or formatting issues in the token.
Scope Configuration: Verify that the scope parameter in the srcclr block is set correctly. It should match the scope in which your project dependencies are defined (e.g., compile, runtime, etc.).
Project Structure: Ensure that your project structure is set up correctly and that Gradle is able to locate and interpret the dependencies. Sometimes, unusual project structures or misconfigurations can cause Gradle to overlook dependencies.
I hope this will help you.