Setting up the Static Analyzer Command Line Utility for use with SCA
For Software Composition Analysis, download a small Command Line Utility. When you extract the utility to your local disk, you can use its command line interface (CLI) to perform security analysis.
About this task
When you use SCA, you scan source code to generate a file that is uploaded to the cloud. The file, an encrypted IRX (.irx) file, is scanned using trace analysis to find security vulnerabilities.
Procedure
-
Select the platform on which you plan to run the Command Line Utility, and then click
Download. This downloads an
SAClientUtil_<version>_<os>.zip
file (where <version> is the current version of the Command Line Utility and <os> is the operating system that the Command Line Utility is for).Note: You can reopen the welcome form by selecting How do I create an IRX file? in the form to select an IRX file. - Extract the file to a local drive.
-
If you plan to use the CLI for IRX file generation,
uploading IRX files, or for managing scans: Add the location
of the \bin directory of the extracted
SAClientUtil_<version>_<os>.zip
file to yourPATH
environment variable. If you do not do this, all commands will need to be qualified by using the \bin directory of the extractedSAClientUtil_<version>_<os>.zip
file each time the command is issued.Tip: After you change thePATH
, issueappscan version
(Windows™) orappscan.sh version
(Linux™ and macOS) at a command prompt. If the Static Analyzer Command Line Utility version, home, and other information are returned, thePATH
is set correctly.
What to do next
If you are running the Command Line Utility on a computer that is behind a proxy, use one of these methods for specifying the proxy so that the Command Line Utility can connect to the cloud:
- Command Line Utility CLI and supported integrated development
environments (IDE): Set this global or system environment variable so that the
proxy is automatically recognized:
- Windows:
APPSCAN_OPTS=-Dhttps.proxyHost=<proxy> -Dhttps.proxyPort=<port>
- Linux and macOS:
APPSCAN_OPTS="-Dhttps.proxyHost=<proxy> -Dhttps.proxyPort=<port>"
Where
<proxy>
is the host name of the proxy server and<port>
is the port number that the proxy server is using.Or, each time that you use the CLI or IDE (launched from a command prompt or terminal), you can set the Command Line Utility to use the proxy by issuing a command:
- Windows™:
set "APPSCAN_OPTS=-Dhttps.proxyHost=<proxy> -Dhttps.proxyPort=<port>"
- Linux™ and macOS:
export APPSCAN_OPTS="-Dhttps.proxyHost=<proxy> -Dhttps.proxyPort=<port>"
- Windows:
- Maven: If you added the static analysis plug-in to Maven, you can add the property to the
MAVEN_OPTS
environment variable globally or you can add the property to each command.
- Static Analyzer Command Line Utility updates are available on
a regular basis and details listed in Recent updates.
Updates may include:
- New language support
- Updated language support (new files types associated with supported languages, for example)
- New features
- Fixes
- Plugins automatically download the latest Static Analyzer Command Line Utility when they run.
- If you try to prepare code for scanning using an outdated version of the Static Analyzer Command Line Utility, you may see a message directing you to update the utility to the latest version. Upgrade to the latest Static Analyzer Command Line Utility based on your operating system (Windows, Linux, Mac).
- If you are using AppScan Go!, accept and install the latest update if an update is offered.