Checkmarx SCA Resolver Configuration Arguments

Account

-a| --account

Account

Your SCA account a name.

Online, Upload

-

Authentication Server URL²

--authentication-server-url

AuthenticationServerUrl

The URL of the SCA Access Control server.

Online, Upload

https://platform.checkmarx.net

Path to save container results

--containers-result-path

ContainersResultPath

Specify the path to the directory/file where the containers results will be saved (for future upload).

Offline

-

Path to read container results

--containers-result-path

ContainersResultPath

Specify the path to the file of the saved containers results that you are uploading.

Upload

-

Logs Directory^3]

--logs-path

LogsDirectory

The default name assigned the logs directory.

logs

Project Name

-n| --project-name

ProjectName

To scan an existing SCA Project, enter the Project name. Alternatively, you can enter a new Project name in order to create a new Project in SCA.

All

-

Password^1]

-p| --password

Password

The password for your SCA user account.

Online, Upload

-

Path to save ScaResolver results

-r|--resolver-result-path

ResolverResultPath

Specify the path to the directory/file where the resolver results will be saved (for future upload).

Offline

-

Path to read ScaResolver results

-r|--resolver-result-path

ResolverResultPath

Specify the path to the file of the saved resolver results that you are uploading.

Upload

-

SCA Application URL^3]

--sca-app-url

ScaAppUrl

The URL of the SCA web application.

Online, Upload

https://sca.checkmarx.net

Server URL^2]

--server-url

ServerUrl

The URL of the SCA API server.

Online, Upload

https://api-sca.checkmarx.net

Scan Path

-s| --scan-path

N/A

Path to the folder to be scanned.

Online, Offline

-

Provider name^1]

--sso-provider

SsoProviderName

The name of your SSO provider. Alternatively, you can give the name of your Master Access Control instance. For more info see SAML Authentication for Checkmarx SCA Resolver

Online, Upload

-

Username^1]

-u| --username

Username

Your username for the SCA account.

Online, Upload

-

Break on manifest failure

--break-on-manifest-failure

BreakOnManifestFailure

When this flag is used, the scan will fail and error code 9 will be returned when resolution fails for one or more of the manifest files.

Online, Offline

False

Bypass exit code

--bypass-exitcode

BypassExitCode

If set as “true”, exit code will be overridden and set as 0, enabling it to pass through the CI/CD pipeline.

All

False

Change configuration file

-c| --config-path

N/A

Changes the cofig file used for the scan.

All

Configuration.yml

Path to cache containers image

--containers-cache-path

ContainersImagesCacheDirectory

Path to the directory where containers images cache will be written.

Online, Offline

Cache

Save containers result output

--containers-result-path

N/A

Save containers results, which is helpful for troubleshooting. You need to specify the path to the directory where you want the output to be saved.

Online

None

Disable parameters sanitization

--disable-parameter-sanitization

DisableParameterSanitization

Disable package managers additional parameters sanitization.

Online, Offline

False

Excludes

-e| --excludes

ExcludePatterns

Specify file and folder patterns to be excluded from the zip file that will be scanned.

See examples below.

Online, Offline

Default excluded folders:

node_modules,

bower_components,

.git,

vendor,

Carthage

Extensions to be extracted

--extract-archives

N/A

Submit comma separated archives extensions to be extracted.

Online, Offline

“.zip, .ear, .war”

Extraction depth level

--extract-depth

N/A

The depth level of file extraction.

Online, Offline

1

Gradle Dev Scopes

--gradle-dev-scopes

N/A

Gradle user defined dev dependencies scopes.

Online, Offline

None

Gradle Exclude Scopes

--gradle-exclude-scopes

N/A

Gradle dependencies excluded scopes.

Online, Offline

None

Gradle Excluded Submodules

--gradle-ignore-modules

N/A

Ignore Gradle sub-modules.

Online, Offline

None

Gradle Include Modules

--gradle-include-modules

N/A

Gradle include only desired project submodules.

Online, Offline

None

Gradle Include Scopes

--gradle-include-scopes

N/A

Gradle dependencies included scopes.

Online, Offline

None

Gradle Plugin Scopes

--gradle-plugin-scopes

N/A

Gradle user defined plugin scopes.

Online, Offline

None

Help

--help

N/A

Shows a list of supported arguments for SCA Resolver in the console output.

All

N/A

Ignore Dev Dependencies

--ignore-dev-dependencies

IgnoreDevDependencies

Ignores dev dependencies in the pre-scan stage.

Online, Offline

False

Images to scan

--images

N/A

Specify the container images to be scanned as a comma separated list.

Online, Offline

None

Path to save Ivy reports

--ivy-report-files-dir

N/A

Specify the todir for writing reports when resolving dependencies in Ivy.

Online, Offline

False

Ivy report target

--ivy-report-target

N/A

Specify the target name for the target for writing reports when resolving dependencies in Ivy.

Online, Offline

False

Log Level

--log-level

LogLevel

This value sets the lowest threshold for log messages.

Enter one of the following enum values:

Verbose, Debug, Information, Warning, Error, Fatal

All

Information

Path to project’s manifest

--manifests-path

ManifestsPath

When this argument is set, the manifest file in the specified path is uploaded to Checkmarx SCA Cloud.

Upload

When this flag isn’t used, no manifest file is uploaded.

Maximum attempts to check scan status

N/A

ScanReportMaxRetries

The maximum number of requests sent to check the status of the scan.

All

2147483647

Time between scan report requests

N/A

ScanReportWaitForFinishDelayInSeconds

Time in seconds before resending request for the scan’s risk-report.

Online, Upload

5

Version of pipdeptree

N/A

PipDepTreeVersion

Specify the version of pipdeptree to be used for package resolution.

Online, Offline

None

Additional Manifest Patterns

N/A

AdditionalManifestPatterns

Allows the user to specify additional patterns to detect as manifest.

Syntax:

AdditionalManifestPatterns:  
  pip: 
    - example-*.txt

Online, Offline

N/A

Version of Graphviz

N/A

GraphvizVersion

Specify the version of Graphviz to be used for package resolution.

Online, Offline

N/A

Custom NetRc path

--netrc-path

NetRcPath

Specify the path to the NetRc file to be used.

Online, Offline

None

Disable manifest upload

--no-upload-manifest

N/A

When this argument is set, the manifest files are not uploaded to Checkmarx SCA Cloud.

Online

False (i.e., manifest files are uploaded)

Path to nuget CLI executable

--nugetcli-path

NugetCliPat

Specify the path to nuget CLI executable to be used.

Online, Offline

False

Disable default exclusions

--override-default-excludes

OverrideDefaultExcludes

When this is set, the only folders and files that are excluded are those specified in the --excludes flag.

Online, Offline

false

Private dependency name (BETA)

--private-dependency-name

PrivateDependencyName

The name of the private package.

This flag must be used in conjuction with --private-dependency-version and --private-dependency-type.

Online, Offline

False

Private dependency type (BETA)

--private-dependency-type

PrivateDependencyType

The package manager used for accessing the private package. For example, Go, Nuget, Npm, maven etc.

Online, Offline

False

Private dependency version (BETA)

--private-dependency-version

PrivateDependencyVersion

The version of the package.

Online, Offline

False

Add tags to project

--project-tags

N/A

Comma separated tags to be assigned to the project. Tags can be simple string or key:value.

Online, Upload

None

Proxy

--proxies

N/A

The proxy to be used for making internet requests. You can enter comma separated proxies for HTTP and HTTPS. You can also include authentication credentials for HTTPS. See You

Online, Offline

None

Python version

--python-version

PythonVersion

Specify the Python version to be used for package resolution.

Enter one of the following enum values:

V2 or V3

Online, Offline

V3

Quiet mode

-q| --quiet

N/A

When this flag is used, logs aren't returned to the console output. However, the logs are still written to the log files.

Online

False

Save resolved dependency output

--save-evidence-path

N/A

Saves evidence of the resolved dependencies, which is helpful for troubleshooting. You need to specify the path to the directory where you want the output to be saved.

Online

None

Run containers scan

--scan-containers

N/A

Scan the Dockerfiles in your project to identify the container images used in your project. See Container Scans

Online, Offline

False

Add tags to scan

--scan-tags

N/A

Comma separated tags to be assigned per scan. Tags can be simple string or key:value.

Online, Upload

None

Severity Threshold

--severity-threshold

SeverityThreshold

The vulnerability severity level from which

to return an error exit code. Enter one of the following enum values: Low, Medium, High or None (do not test)

Online, Upload

None

Project Teams

-t| --project-teams

N/A

Comma separated list of teams to assign to a newly created project. If the project exists, this is ignored.

The full team hierarchy should be given, e.g: /CxServer/Team01/Team01a

Team path should be prefixed by forward slash: /

Online, Upload

Project will be accessible to all users

Version

-v| --version

N/A

Prints the version to console output.

All

N/A