5

Recently submitted an app to the Force.com source code scanner by CheckMarx, after 5 days still there is no sign of scanning report. It will be helpful if that tool tells some approx waiting period. But unfortunately no such intuitive messages from that tool. It was working fine a month ago.

Curiously, we got a call from CheckMarx guy and he asked me for any issues. Why is our code scan taking so long to complete?

6
  • 4
    I'm voting to close this question as off-topic because it seems more appropriate to discuss with CheckMarx support.
    – Adrian Larson
    Commented Jan 30, 2017 at 18:48
  • what kind of tie-up does Salesforce have with CheckMarx?? Can Salesforce.com develop a dedicated tool to do this?
    – Bforce
    Commented Jan 30, 2017 at 18:51
  • Usually CheckMarx is quick. I'm getting my confirmation with in 1-2 hours. Never waited for that long. From CheckMarx - "Note that we cannot scan code on NA21, CS32". Make sure you are not using na21 or cs32.
    – SL man
    Commented Jan 30, 2017 at 19:12
  • Thanks, @SLman. No its different instances. Have you tried anything from last week?
    – Bforce
    Commented Jan 30, 2017 at 19:19
  • All the scans in the queue have completed. If you don't have a scan at this point, I would recommend filing a case. Commented Feb 1, 2017 at 13:00

1 Answer 1

8

From my personal experience as an ISV employee, I can say that this is pretty normal during the weeks leading up to a release. Here's the problem: ISVs are given about a month before the release hits to submit bugs, fix their own bugs, scan for security reviews, etc. All those ISVs are busy running scans and so on to make sure their code won't break in the next release.

In other words, each new release generates a ton of work for everyone. Checkmarx is just one kink in the process. The Security Review Team typically gets backed up 2-4 weeks before a release, Checkmarx's free scanner gets clogged up with pre-release checks, Partner Support gets swamped with support requests, etc. There's only so many resources available, both in terms of hardware and employees, so they have to make some compromises. In about a month or so, everything will be fine until June or so...

If you absolutely need to get scanned "yesterday," you might need to shell out for the on-premise version. In addition to faster scans, you also get unlimited lines of code (LOC) scanning, while the free version is limited to the number of resources it will scan. The free tool is really rather meant for smaller ISVs, and not the likes of Astadia and Blue Wolf, much like a Developer Edition is meant more for "small" developers, while the ISV Developer Editions have significantly more capacity in terms of storage, licenses, etc.

I've personally seen scans that were received within the hour, and scans that were measured in weeks. There's really no way to know how long it will take, because each request is a different size, different complexity, etc. There's no "progress bar" that CheckMarx can just look at to tell you a time estimate. Some orgs can be scanned in seconds, others may take minutes or hours of actual CPU time. It would be meaningless to provide an estimated time remaining.

2
  • Thanks for the splendid explanation @sfdcfox. We are planning to buy a license for a single user. Can you please let me know the price if you know?
    – Bforce
    Commented Jan 30, 2017 at 19:22
  • 2
    @Bforce I've never been in a position to know, but I hear it's very competitively priced. For a non-official (i.e. won't be accepted by the Security Team) pre-security scan, consider PMD. It's an open-source scanner that identifies a ton of issues. I personally haven't had a chance to use that, either, but it can save you days/weeks of waiting for an official report only to find you have a hundred security flags.
    – sfdcfox
    Commented Jan 30, 2017 at 19:29

Not the answer you're looking for? Browse other questions tagged .