System requirements for SCA

The types of files that can be scanned by ASoC when you perform open source testing.

Language support

AppScan on Cloud strives to support as many open source packages as possible; we update CVE data daily. However, license information may not always be available for less common packages.

Note:
For some package managers, you must be able to build the project before testing it with ASoC. Some dependencies are only resolved when the project is built.
Table 1.
Language and version Supported binary file types (metadata) Supported source/binary file types (hash) Package/Build manager and version (config/manifest) Package/Build manager supported config files
.NET
  • .dll
  • .exe
  • .dll
  • .exe
  • .lib
  • Nuget
  • The project is already built and all build outputs include projects.assets.json or packages.lock.json.

    OR

  • .NET CLI and Nuget installed with the ability to build successfully and the project includes the build file *.csproj.

    OR

  • The project includes a *.csproj file, and the scan is either run with estimated dependency mode enabled or performed as a repository/ZIP scan.
  • Paket
  • The project is already built and all build outputs include packet.lock.

    OR

  • .NET and Paket is installed with the ability to install and restore successfully, and the project includes the config files paket.dependencies and paket.references.

    OR

  • The project includes a paket.dependencies, paket.references files, and the scan is either run with estimated dependency mode enabled or performed as a repository/ZIP scan.
  • .NET Framework 3.5, 4.6.2, 4.7.2, 4.8, 4.8.1
  • .NET 5, 6, 7, 8
 For .NET only, SCA can analyze the configuration file before build, but the results will include only direct libraries and will be less accurate.
C/C++

  • .exe

  • .dll
  • .c
  • .cc
  • .cpp
  • .hpp
  • .dll
 Conan
  • Conan must be installed, the project must be buildable, and a valid conanfile.txt or conanfile.py file must exist.
  • The project includes a conanfile.txt or conanfile.py file, and the scan is either run with estimated dependency enabled or performed as a repository/ZIP scan.
Dart .dart
  • .dart
 Dart Pub
  • The project must include pubspec.yaml and pubspec.lock.

    OR

  • The Dart SDK must be installed with the ability to run dart pub get successfully, and the project must include the pubspec.yaml configuration file.

    OR

  • The project includes a pubspec.yaml file, and the scan is either run with estimated dependency enabled or performed as a repository/ZIP scan.
GO
  • .dll
  • .exe
  • .go
 Go Modules (GO version 1.15 and later)
  • GO and GO CLI installed, and the project includes the config file go.mod.
  • The project includes a go.mod file, and the scan is either run with estimated dependency enabled or performed as a repository/ZIP scan.
Java
  • .ear
  • .jar
  • .war
  • .ear
  • .jar
  • .war
 Java with Maven
  • Maven must be installed and the pom.xml project must be buildable.
  • The project includes a pom.xml file, and the scan is either run with estimated dependency enabled or performed as a repository/ZIP scan.
Java/Kotlin with Gradle

  • Gradle.lockfile must exist for every project,

    OR

  • Gradle must be installed with the ability to read and edit build.gradle or build.gradle.kts files.

  • The project includes a build.gradle or build.gradle.kts file, and the scan is either run with estimated dependency enabled or performed as a repository/ZIP scan.
JavaScript NodeJS
  • .js
 NPM (version 5.0.0/2017 and newer)
  • Create the project after building. The project must include package.json and package-lock.json .

    OR

  • NPM CLI is installed with the ability to run npm install and project includes the config file package.json.

    OR

  • The project includes a package.json file, and the scan is either run with estimated dependency enabled or performed as a repository/ZIP scan.
Yarn Classic (versions 1.x) and Yarn Berry (versions 2.x, 3.x, and 4.x)
  • The project must include package.json and yarn.lock.
OR
  • Yarn CLI is installed with the ability to run yarn install and project includes the config file package .json.
  • The project includes a package.json file, and the scan is either run with estimated dependency enabled or performed as a repository/ZIP scan.
PHP
  • .php
Composer
  • PHP and Composer must be installed, and a valid composer.json file must exist.
  • The project includes a composer.json file, and the scan is either run with estimated dependency enabled or performed as a repository/ZIP scan.
Python (version 3.3 and newer)
  • .py
  • .whl
Note:
When scanning .py and .whl files, the project should be built as a virtual environment (venv).
 Pip (version 3.4 and newer)
  • Python and Pip installed AND one of the configuration files:setup.py OR requirements.txt
  • The project includes a setup.py OR requirements.txt file, and the scan is either run with estimated dependency enabled or performed as a repository/ZIP scan.
Poetry (all versions)
  • Create the project after building with the configuration files pyproject.toml and poetry.lock.

    OR

  • Python and Poetry are installed with the ability to poetry.lock successfully, and project includes the config file pyproject.toml.

    OR

  • The project includes a pyproject.toml file, and the scan is either run with estimated dependency enabled or performed as a repository/ZIP scan.
UV (all versions)

  • Create the project after building with the configuration files pyproject.toml and uv.lock.

    OR

  • UV is installed and able to generate uv.lock successfully, and the project includes the config file pyproject.toml.

    OR

  • The project includes a pyproject.toml file, and the scan is either run with estimated dependency enabled or performed as a repository/ZIP scan.
Note:
UV is given the highest priority among Python package managers for pyproject.toml-based projects. If UV is not installed, the scanner automatically falls back to Poetry, and then to Pip.
Note:
AppScan on Cloud limits file uploads to 2GB.