Resolving Dependencies

Fortify Static Code Analyzer supports two dependency management systems built into Go:

• Modules

  Fortify Static Code Analyzer downloads all required dependencies using the native Go toolchain. If access to the internet is restricted on the machine where you run Fortify Static Code Analyzer, then do one of the following:

  • If you are using an artifact management system such as Artifactory, set the GOPROXY environment variable or use the -goproxy option described in Go Command-Line Options.

  • Download all required dependencies using modules and vendoring.

• GOPATH dependency resolution

  If you are using a third-party dependency management system such as dep, you must download all dependencies before you start the translation.