veracode scan
Performs a scan of a local or remote container. Learn about Veracode Container and IaC Security.
After the first scan, the Veracode CLI caches the vulnerability databases to improve performance in future scans. The CLI stores the cached data in the tmp directory on your machine. Use the --temp flag to change the location of the temporary directory.
If you want to run Veracode Container and IaC Security scans in a Docker container, ensure you have installed a package containing compatibility libraries for glibc, such as libc6-compat.
Usage
./veracode scan --type <string> --source <string> --policy policy-container-scan.rego [flags]
Flags
| Flag | Description |
|---|---|
-p --policy | The policy to be used for the scan. The name of the policy must not contain special characters such as /, \, or +. |
-f, --format | Output format for the scan results. Enter one of the following values:json: JSON that uses the Syft JSON schema. See example JSON findingscyclonedx: an XML report that conforms to the CycloneDX 1.6 specification.table: a columnar summary. |
-h, --help | Show help for this command. |
--no-cache | Do not cache data from the scan. |
-o, --output | Print output to specified file. If not provided, output is printed to STDOUT. |
-s, --source | Location of the scan source for the target type. |
--type | The target type. Enter one of the following values:image: identifies a container image as the target. The following base image operating systems are supported:- Alpine Linux - Amazon Linux - CentOS - Debian - GitLab BusyBox and Distroless - Oracle Linux - Red Hat Enterprise Linux - Ubuntu repo: identifies a repository as the target.archive: identifies an archive as the target.directory: identifies a directory as the target. |
-v, --verbose | Display verbose output. |
--temp | Specify the location of the temporary directory used to store cached data. On Windows systems, the default cache location is the directory specified by the %TEMP% environment variable. If that is inaccessible, as it may in Azure DevOps pipelines, use --temp "$env:Agent_TempDirectory". |
--schema-version | Determines the type of JSON output. Enter one of the following values:v1: the legacy output. This is the default output.v2: fully normalized output with consistent camelCase keys and uppercase severity values. |
--app-name | The application profile to link to the scan. If you don't provide this flag, scan results are available only to the Security Lead. |
--create-app | Creates an application profile and links the scan to it. If you use this flag without the --app-name flag, the application profile name is generated automatically. If you don't use the --teams flag with this flag, the application profile is assigned to all teams that the user belongs to. |
--teams | When creating an application profile for a scan, use this flag to assign the application profile to a team. You can use this flag only with the --create-app flag. |
Examples
To use an image as the source, run:
./veracode scan --source alpine:latest --type image --policy policy-container-scan.rego
To use a directory as the source, run:
./veracode scan --source path/to/directory/or/file --type directory --policy policy-container-scan.rego
To use a repository as the source, run:
./veracode scan --source https://github.com/veracode/veracode-sca --type repo
To use an image as the source, return fully normalized output, and write the results to a file, run:
./veracode scan --source alpine:latest --type image --format json --schema-version v2 --output results.json
To create an application profile and link a scan to it, run:
veracode scan --source ./ --type directory --app-name new-app --create-app
Limitations
The Veracode CLI provides limited scan output for Gradle projects that have not been built. To download a policy in the Rego format, create the policy for container and IaC scans only. If a policy contains rules for both SCA and Container and IaC scans, you can't download it.