DRahn Medaglia133175 (Community Member) asked a question.
Specifically, I'm using a wrapper library to ZeroMQ, which is great. However, veracode says there's an error in the uploaded package file. There does not seem to be a way to include the C code in the vendor packages. The instructions actually state non-go files should be removed.
Here's the trace:
Support Issue (fatal): Parse failure: Error:
Sourcefile errors in the archive
Trace:
services/network/vendor/github.com/pebbe/zmq4/reactor.go:10:4: undefined: State
services/network/vendor/github.com/pebbe/zmq4/reactor.go:11:9: undefined: State
services/network/vendor/github.com/pebbe/zmq4/reactor.go:21:16: undefined: Socket
services/network/vendor/github.com/pebbe/zmq4/reactor.go:23:12: undefined: Poller
services/network/vendor/github.com/pebbe/zmq4/reactor.go:61:34: undefined: Socket
services/network/vendor/github.com/pebbe/zm
.png){kind=logo}
Hi @DRahn Medaglia133175 (Community Member) ,
Veracode does not currently support analysis of CGo components. If you are directly using a CGo component and want to make use of Veracode Static Analysis you could replace it with a 'stub' that does not use CGo.
My colleague @Anthony Fielding (Veracode) has created such a stub for 'pebbe/zmq4' and made it available at: https://github.com/antfie/veracode-static-go-stub-zmq4 .
Please consider reading the README on instructions on how to use this.
For more information please contact @Anthony Fielding (Veracode) at afielding@veracode.com or feel free to contact me at bbaukema@veracode.com .
Thank you,
Boy Baukema