Setup Veracode Applications for Knowledge Agents

[drcgjung]

Topics (Please mark an [x] to your Topic):

• [ ] KICS
• [ ] Invicti
• [ ] GitGuardian
• [ ] Pentesting
• [ ] Security assessment (threat modeling, code reviews)
• [ ] Trivy
• [x] Veracode (initial setup, GitHub integration)
• [ ] Other

Please describe your request:

We have successfully setup veracode sast scans in the following two repos

https://github.com/eclipse-tractusx/knowledge-agents/actions/workflows/veracode.yml https://github.com/eclipse-tractusx/knowledge-agents-edc/actions/workflows/veracode.yml

However, access/creation of the applications is denied (API ID/KEY should be set, the workflow checks that)

https://github.com/eclipse-tractusx/knowledge-agents-edc/actions/runs/5933678459/job/16089441802 [23.08.22 02:19:18] Attempting to create a new application profile with name "knowledge-agents-edc/agentplane-azure-vault" and criticality "Very High". https://github.com/eclipse-tractusx/knowledge-agents-edc/actions/runs/5933678459/job/16089441915 Attempting to create a new application profile with name "knowledge-agents-edc/agentplane-hashicorp" and criticality "Very High".

https://github.com/eclipse-tractusx/knowledge-agents/actions/runs/5933698729/job/16089491741 [23.08.22 02:20:52] Attempting to create a new application profile with name "knowledge-agents/provisioning-agent" and criticality "Very High". https://github.com/eclipse-tractusx/knowledge-agents/actions/runs/5933698729/job/16089491835 [23.08.22 02:21:37] Attempting to create a new application profile with name "knowledge-agents/remoting-agent" and criticality "Very High". https://github.com/eclipse-tractusx/knowledge-agents/actions/runs/5933698729/job/16089491922 [23.08.22 02:21:11] Attempting to create a new application profile with name "knowledge-agents/conforming-agent" and criticality "Very High".

I guess someone needs to create these applications first? Furthermore, if you could be so kind to add these applications to my veracode account "c-jung@t-systems.com"

Thank you!

[scherersebastian]

I created the Veracode apps. You can see them in your Veracode dashboard. Thanks for the detailed descirption.

[scherersebastian]

You need to enable the upload for knowledge-agents

[scherersebastian]

It's working fine for knowledge-agents-edc

[drcgjung]

First: Thank you very much for all that helpful and very responsive support. I already mentionied it yesterday in the Q-Gate meeting, but I wanted you to get that feedback also personally.

It's working fine for knowledge-agents-edc

Mixed ORG_VERACODE with VERACODE Prefix, copy&paste done incredibly unintelligent ... thx for noticing.

[drcgjung]

All Applications can be seen now. Thx.

[drcgjung]

Sorry to bother again. Unfortunately, I guess there is a typo in a single application name, didn't notice it until the workflow run

https://github.com/eclipse-tractusx/knowledge-agents/actions/runs/5971134652/job/16199746355

[23.08.25 02:22:08] [23.08.25 02:22:08] Attempting to create a new application profile with name "knowledge-agents/remoting-agent" and criticality "Very High". [23.08.25 02:22:08] [23.08.25 02:22:08] Action "UploadAndScan" returned the following message: [23.08.25 02:22:08] Access denied. [23.08.25 02:22:08]

[scherersebastian]

Thanks for the hint - my mistake, sorry. I fixed the typo. Name is now: "knowledge-agents/remoting-agent"

[drcgjung]

thx much