Dart and Flutter packaging
Veracode requires your Flutter artifacts to meet specific packaging and compilation requirements before scanning.
For instructions for other platforms, see Supported languages and platforms.
You can analyze artifacts using Veracode Static Analysis, if you have a license.
Automated packaging
Autopackaging automates the packaging process for Dart and Flutter projects.
Required files
Veracode supports mobile artifacts for iOS and Android written in Flutter and packaged as an iOS Archive (IPA) or an Android Package (APK).
Veracode requires a debug build of your Flutter artifacts.
Supported platforms and compilers
| Language | Platform | Supported versions |
|---|---|---|
| Dart | Android, iOS | 2.17, 2.18, 2.19, 3.0, 3.1, 3.2, 3.3, 3.4, 3.5, 3.6, 3.7, 3.8, 3.9, 3.10, 3.11, 3.12, 3.13 |
| Flutter | Android, iOS | 3.0, 3.3, 3.7, 3.10, 3.13, 3.16, 3.19, 3.22, 3.24, 3.27, 3.29, 3.32, 3.35, 3.38, 3.41, 3.44, 3.47 |
Packaging Guidance
Veracode Static Analysis supports two packaging methods for Flutter applications. Select only one option to avoid duplicate flaw reporting.
Option 1: Package as Android APK (preferred)
This option analyzes both Dart code and native Android components.
To build a debug APK, run:
flutter build apk --debug
The APK is in build/app/outputs/flutter-apk. Submit this APK to Veracode for scanning.
Option 2: Package as iOS IPA
Use this option only if an Android APK is not available.
This option analyzes Dart code but doesn’t increase coverage beyond what the Android package already provides.
To build a debug IPA, run:
flutter build ipa --debug
The IPA is in build/ios/ipa. Submit this IPA to Veracode for scanning.
These commands assume a standard Flutter project setup. If your project uses custom build variants, signing profiles, or output paths, update the commands before you submit.