Skip to main content

Swift SCA agent-based scanning

You can find vulnerabilities in your Swift applications using Veracode Software Composition Analysis agent-based scanning. You can run a scan on Swift repositories using the agent-based scanning command-line interface or the CI integrations.

Veracode SCA agent-based scanning supports scanning Swift repositories managed with CocoaPods. It does not support the Swift package manager.

For packaging instructions for Veracode Static Analysis and Veracode SCA upload scans, see Packaging iOS and tvOS applications.

You can use agent-based scanning to scan any code repository to which you have access and fulfills the above requirements. To run an example scan, you can clone one of the public Veracode SCA repositories:

git clone https://github.com/veracode/example-swift-cocoapods

Before you begin:

Scanning a repository that uses Swift and the CocoaPods package manager requires you to assemble the project dependencies within the environment in which you scan the project. Your environment must:

  • Meet the requirements for the Veracode SCA agent
  • Have access to the Swift repository
  • Have a podfile.lock file present in the Swift repository
    • If podfile.lock does not exist in the project root where you perform scans, you must be able to run the pod install command from the project root.

To complete this task:

  1. Run the scan command with the Veracode SCA CLI agent pointed to the directory of the Swift repository. For example:

    srcclr scan path/to/{project_folder}
    note

    To scan code repositories hosted in Git, use the --url argument with the CLI agent.

    To view more verbose output during the scan process, you can add the --loud argument:

    srcclr scan path/to/{project_folder} --loud

Results:

The Veracode SCA agent uses the native package managers to identify the dependencies and their versions in your project. When the agent evaluates the open-source libraries in use, it produces a summary of the scan results. This summary includes counts for total libraries used, vulnerable libraries, percentage of third-party code, and a list of the vulnerabilities found.

Next steps:

After completing the scan, you can view the results.