MKaszubski560801 (Community Member) asked a question.
When running veracode scanner inside docker (Linux) I'm getting following stacktrace. When I run it outside of docker (windows) it is fine... Not sure what the problem is here. I've compare content of directories / dotnet versions and it seems the same. Any helps / hints would be highly appreciated 🙂
curl -sSL https://sca-downloads.veracode.com/ci.sh | sh -s scan --debug --recursive --allow-dirty --no-upload
2025-08-07/08:49:04.083 com.sourceclear.agent.services.ScanServiceImpl DEBUG Dependency analysis completed
2025-08-07/08:49:04.086 com.sourceclear.agent.services.ScanServiceImpl DEBUG Dynamic call graph analysis skipped because no supported language was found
2025-08-07/08:49:04.086 com.sourceclear.agent.services.ScanServiceImpl DEBUG Computing static call graph
2025-08-07/08:49:04.103 com.sourceclear.engine.common.ProjectDLLUtils DEBUG Found msbuild files: [/src/MyNamespace.Localization.Kubernetes/MyNamespace.Localization.Kubernetes.csproj]
2025-08-07/08:49:04.103 com.sourceclear.engine.methods.SimpleFileMethodScanBatcher DEBUG Looking for files of type: [MyNamespace.Localization.Kubernetes.dll]
2025-08-07/08:49:04.110 com.sourceclear.engine.methods.SimpleFileMethodScanBatcher DEBUG Found files: [/src/MyNamespace.Localization.Kubernetes/bin/Release/net8.0/MyNamespace.Localization.Kubernetes.dll, /src/MyNamespace.Localization.Kubernetes/obj/Release/net8.0/MyNamespace.Localization.Kubernetes.dll, /src/MyNamespace.Localization.Kubernetes/obj/Release/net8.0/ref/MyNamespace.Localization.Kubernetes.dll, /src/MyNamespace.Localization.Kubernetes/obj/Release/net8.0/refint/MyNamespace.Localization.Kubernetes.dll]
Found 4 MyNamespace.Localization.Kubernetes.dll files for vulnerable method analysis.
2025-08-07/08:49:04.120 com.sourceclear.api.client.SourceClearClient DEBUG HTTPS connection is expanded to accept wider range of ciphers
2025-08-07/08:49:04.739 com.sourceclear.methods.dotnet.DotNetCallGraphBuilder WARN Unable to read dll to compute call graph: /src/MyNamespace.Localization.Kubernetes/bin/Release/net8.0/MyNamespace.Localization.Kubernetes.dll
com.fasterxml.jackson.core.JsonParseException: Unrecognized token 'No': was expecting (JSON String, Number, Array, Object or token 'null', 'true' or 'false')\n at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION` disabled); line: 1, column: 4]
at com.fasterxml.jackson.core.JsonParser._constructError(JsonParser.java:2590)
at com.fasterxml.jackson.core.JsonParser._constructReadException(JsonParser.java:2616)
at com.fasterxml.jackson.core.JsonParser._constructReadException(JsonParser.java:2624)
at com.fasterxml.jackson.core.base.ParserMinimalBase._reportError(ParserMinimalBase.java:830)
at com.fasterxml.jackson.core.json.UTF8StreamJsonParser._reportInvalidToken(UTF8StreamJsonParser.java:3662)
at com.fasterxml.jackson.core.json.UTF8StreamJsonParser._reportInvalidToken(UTF8StreamJsonParser.java:3635)
at com.fasterxml.jackson.core.json.UTF8StreamJsonParser._matchToken(UTF8StreamJsonParser.java:2959)
at com.fasterxml.jackson.core.json.UTF8StreamJsonParser._handleUnexpectedValue(UTF8StreamJsonParser.java:2726)
at com.fasterxml.jackson.core.json.UTF8StreamJsonParser._nextTokenNotInObject(UTF8StreamJsonParser.java:867)
at com.fasterxml.jackson.core.json.UTF8StreamJsonParser.nextToken(UTF8StreamJsonParser.java:753)
at com.fasterxml.jackson.databind.ObjectMapper._initForReading(ObjectMapper.java:5058)
at com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:4961)
at com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:3932)
at com.sourceclear.analysis.dotnet.Executable.readClasses(Executable.java:181)
at com.sourceclear.analysis.dotnet.Executable.execute(Executable.java:245)
at com.sourceclear.analysis.dotnet.Executable.getClasses(Executable.java:129)
at com.sourceclear.analysis.dotnet.SrcDot.getClasses(SrcDot.java:40)
at com.sourceclear.methods.dotnet.DotNetCallGraphBuilder.<init>(DotNetCallGraphBuilder.java:67)
at com.sourceclear.methods.dotnet.DotNetMethodScannerFactory.forFiles(DotNetMethodScannerFactory.java:55)
at com.sourceclear.engine.methods.SimpleFileMethodScanBatcher.batch(SimpleFileMethodScanBatcher.java:82)
at com.sourceclear.engine.methods.BaseMethodsEngine.innerScanMethods(BaseMethodsEngine.java:114)
at com.sourceclear.engine.methods.DotNetMethodsEngine.scanMethods(DotNetMethodsEngine.java:28)
at com.sourceclear.engine.methods.VulnerableMethodsCollatorImpl.scanPath(VulnerableMethodsCollatorImpl.java:196)
at com.sourceclear.engine.scan.LibraryGraphContainerScanner.doVulnMethodsScan(LibraryGraphContainerScanner.java:247)
at com.sourceclear.agent.services.ScanServiceImpl.buildReport(ScanServiceImpl.java:256)
at com.sourceclear.agent.commands.ScanCommand.lambda$executeRepoScan$5(ScanCommand.java:1013)
at com.sourceclear.agent.commands.ScanCommand.handleScanErrors(ScanCommand.java:1210)
at com.sourceclear.agent.commands.ScanCommand.executeRepoScan(ScanCommand.java:1002)
at com.sourceclear.agent.commands.ScanCommand.execute(ScanCommand.java:668)
at com.sourceclear.agent.EntryPointImpl.runVerb(EntryPointImpl.java:382)
at com.sourceclear.agent.EntryPointImpl.dispatchVerbOptions(EntryPointImpl.java:331)
at com.sourceclear.agent.EntryPointImpl.apply(EntryPointImpl.java:156)
at com.sourceclear.agent.Main.start(Main.java:118)
at com.sourceclear.agent.Main.main(Main.java:123)
.png){kind=logo}
Update on my investigation: when I use image based on mcr.microsoft.com/dotnet/sdk:8.0 (Debian 12) it does not work , when I use image based on mcr.microsoft.com/dotnet/sdk:8.0-alpine (Alpine 3.21) it works. So it has sth to do with dependencies of scanning tool. I'm not sure what is missing.
@MKaszubski560801 (Community Member) I'm told that one thing you will definitely want to do is make sure you're using the latest version of the SCA agent. That may address this issue
Hi @MKaszubski560801 (Community Member) we'll need to dive a bit deeper here to be able to provide advice. Please submit a case to our team here: https://community.veracode.com/s/contact-support
@SamHouston (Veracode) thanks for quick answer! For others that are facing similar issue. I was able to get rid of this error in the Debian based image by removing '--no-upload' flag. I was using this flag to keep my scan results clean during development, so I do not need it. Shall I still create a ticket, do you want to have a look? I think there is still some issue in the scanner / deps itself.
Glad that you found a workaround @MKaszubski560801 (Community Member) - If you're able, we'd still be interested in a support ticket so that we can try to understand what's causing the underlying issue.
I've created a ticket as issue appeared again and removing flag did not solve it -> Case: 00964615