Skip to main content

Go SCA agent-based scanning

You can find vulnerabilities in your Go applications using Veracode Software Composition Analysis agent-based scanning. You can run a scan on Glide, go get, Go modules, Godep, Govendor, and Trash repositories using the agent-based scanning command-line interface or the CI integrations.

For packaging instructions for Veracode Static Analysis and Veracode SCA upload scans, see Packaging Go applications.

You can use agent-based scanning to scan any code repository to which you have access and fulfills the above requirements. To run an example scan, you can clone one of the public Veracode SCA repositories:

  • Glide: git clone https://github.com/veracode/example-go-glide
  • Go Get: git clone https://github.com/veracode/example-go-goget
  • Go Modules: git clone https://github.com/veracode/example-go-modules
  • Godep: git clone https://github.com/veracode/example-go-godep
  • Govendor: git clone https://github.com/veracode/example-go-govendor
  • Trash: git clone https://github.com/veracode/example-go-trash

After you add a srcclr.yml file to the directory where you point the Veracode SCA agent, you can specify scan directives for scanning your .NET code. Some scan directives are specific to Go projects.

Before you begin:

Scanning a repository that uses Go and one of its build or package managers requires the ability to assemble the project dependencies within the environment in which you scan the project. This includes these requirements:

  • Meet the requirements for the Veracode SCA agent.
  • Have access to the Go repository.
  • Use Go version 1.5 or later.
  • Ensure that the project can build in the environment where the agent performs scans.
  • Ensure that the GOROOT and GOPATH environment variables are set to the correct directories, and that the bin subdirectory of GOROOT is included in the PATH environment variable. For example, if GOROOT is set to /usr/local/go, you should include /usr/local/go/bin in your PATH. See the Go documentation for more information on configuring Go projects.
  • If you use Godep, Govendor, Glide, or Trash, ensure the package manager is installed.
  • For these tools, meet the specified requirement:
    • Glide: include the Glide.lock file
    • Go get: use Go version 1.5–1.15
    • Godep: include the Godeps/Godeps.json file
    • Golangdep: include the Gopkg.lock file
    • Govendor: include the vendor/vendor.json file
    • Trash: include the vendor.conf file
    • Go modules
      • Run this command: go list -deps -json all
      • Run this command to add any missing modules required for the build: go mod tidy
      • To avoid downloading required packages during scanning, which can decrease scan speeds, run this command to download the packages prior to scanning: go mod vendor
      • Use the GOFLAGS environment variable to pass any arguments required for the build. For example: GOFLAGS='-buildvcs=false'

If you set FORCE_GO_INSTALL to true as a scan directive or environment variable or use the --url argument, the Veracode SCA agent runs specific commands to identify the dependencies and their versions in your project. You can run these commands before scanning to test that the agent can build the project:

  • Glide: glide install
  • Go get: go get -d ./...
  • Godep: godep restore
  • Govendor: govendor sync
  • Trash: trash

To complete this task:

Run the scan command with the Veracode SCA CLI agent pointed to the directory of the Go repository. For example:

srcclr scan path/to/{project_folder}

o scan code repositories hosted in Git, use the --url argument with the CLI agent.

To view more verbose output during the scan process, you can add the --loud argument:

srcclr scan path/to/{project_folder} --loud

Results:

The Veracode SCA agent uses the native package managers to identify the dependencies and their versions in your project. When the agent evaluates the open-source libraries in use, it produces a summary of the scan results. This summary includes counts for total libraries used, vulnerable libraries, percentage of third-party code, and a list of the vulnerabilities found.

Next steps:

After completing the scan, you can view the results.

Last updated on