Overview

When scanning code repositories in Aqua Supply Chain Security, a repository may report zero Software Composition Analysis (SCA) findings even though third-party dependencies are present. This can occur when a dependency manifest file such as requirements.txt is present in the repository but uses a format that the SCA scanner cannot parse.

This article explains why zero SCA findings do not always indicate a clean dependency tree, how to identify manifest parsing failures, and how to correct Python dependency files so SCA analysis evaluates all packages.

Problem Description

Symptoms

When reviewing code repository scan results in Aqua Supply Chain Security, the following symptoms may indicate a manifest parsing issue rather than a genuinely clean dependency tree:

1. 1. Zero SCA Findings Despite Known Dependencies:

- The repository contains a requirements.txt or similar manifest file

- SCA reports 0 third-party library vulnerabilities

- SAST and Sensitive Data scans may also show zero findings

- The Dependencies tab shows no evaluated packages

1. 2. Conda-Exported Manifest Format:

- Each dependency line uses a single equals sign (=) instead of double equals (==)

- Lines include a =pypi_0 or similar build-string suffix

- Example of an unrecognized format:

```

cryptography=47.0.0=pypi_0

asyncssh=2.22.0=pypi_0

```

1. 3. Truncated or Incomplete Manifest File:

- Packages are listed alphabetically but the file ends abruptly

- The committed file does not contain the full dependency list

- Only a partial subset of dependencies appears in the repository

1. 4. Misleading Compliance Status:

- The repository may appear compliant with no third-party vulnerabilities

- AppSec or security teams cannot attest to dependency coverage

- Zero findings may be incorrectly interpreted as a clean bill of health

Impact

• No dependency vulnerability coverage — Third-party libraries are not evaluated against known vulnerability databases
• False compliance attestation — Zero SCA findings suggest a clean dependency tree when no dependencies were actually scanned
• Missed security risk — Known vulnerabilities in dependencies remain undetected until the manifest format is corrected
• Incomplete supply chain visibility — Security teams cannot confirm SCA coverage across SAST, Sensitive Data, and third-party library analysis

Root Cause

Zero SCA findings in this scenario result from manifest detection without successful parsing. Aqua Supply Chain Security detects the presence of dependency manifest files, but SCA analysis depends on the scanner recognizing and resolving dependencies from a supported format.

Why Conda-Exported Formats Fail

Format Mismatch:

• Aqua SCA expects standard pip-style dependency declarations using package==version syntax
• Conda-exported requirements.txt files use a three-part format: package=version=build_string (for example, =pypi_0)
• The SCA scanner does not recognize this Conda export encoding

Parsing Failure:

1. 1. The scanner detects requirements.txt in the repository
2. 2. It attempts to parse each line as a pip dependency
3. 3. Lines with Conda format (package=version=pypi_0) fail to parse
4. 4. No dependencies are resolved or evaluated
5. 5. SCA reports zero findings — not because dependencies are clean, but because none were parsed

Truncated Manifest Files

If the requirements.txt file is incomplete or truncated in the repository, the scanner can only evaluate the dependencies that are present and correctly formatted. A truncated file may further reduce or eliminate parsed dependencies.

Important Distinction

Support verification confirmed this behavior: adding a single correctly formatted entry such as langflow==1.2.0 to the manifest immediately returned 19 vulnerabilities, demonstrating that the scanner functions correctly when the format is valid.

Solution

Step 1: Verify the Manifest File Format

Review the dependency manifest file in your repository and confirm it uses pip-compatible syntax.

Unsupported format (Conda export):

cryptography=47.0.0=pypi_0
asyncssh=2.22.0=pypi_0
numpy=1.26.4=pypi_0

Supported format (pip standard):

cryptography==47.0.0
asyncssh==2.22.0
numpy==1.26.4

Check for these common issues:

• Single = instead of == between package name and version
• =pypi_0 or other build-string suffixes appended to each line
• File ending abruptly with an incomplete alphabetical list

Step 2: Regenerate the Requirements File

Replace Conda-exported or malformed manifest files with a pip-standard format:

# Activate your project virtual environment, then:
pip freeze > requirements.txt

For projects using other package managers, use the appropriate export command:

Ensure the generated file contains the complete dependency list and is not truncated before committing.

Step 3: Commit and Push the Updated Manifest

git add requirements.txt
git commit -m "Fix requirements.txt format for SCA scanning"
git push

Push the change to the branch connected to your Aqua code repository integration to trigger a new scan.

Step 4: Re-Trigger the SCA Scan

After pushing the corrected manifest:

1. 1. Navigate to Supply Chain → Code Repositories in the Aqua console
2. 2. Open the affected repository
3. 3. Confirm a new scan is triggered automatically after the commit, or manually initiate a scan if needed
4. 4. Review the Dependencies tab to verify packages are listed and evaluated

For integrations that support online scanning, pushing a commit triggers a live scan with updated results.

Step 5: Validate SCA Results

Confirm that SCA analysis is now evaluating dependencies:

1. 1. Check the Dependencies tab — Packages should appear with names and versions
2. 2. Review SCA findings — Vulnerabilities should be reported for packages with known CVEs (if any exist)
3. 3. Compare dependency count — The number of evaluated packages should match your expected dependency tree
4. 4. Verify across scan types — Confirm SAST and Sensitive Data coverage separately if required for compliance attestation

Expected outcome after fix:

• Dependencies are listed in the scan results
• SCA findings reflect actual vulnerability status of third-party libraries
• Zero SCA findings (if reported) now genuinely indicate a clean dependency tree

Technical Details

Supported Python Manifest Formats

Aqua Supply Chain Security SCA recognizes standard package manager manifest files, including:

Manifest files must use the native format expected by each package manager. Conda environment exports saved as requirements.txt are not equivalent to pip-format files and will not parse correctly.

Conda vs. Pip Format Comparison

Conda export format (not supported for SCA parsing):

# Generated by conda export — NOT recognized by Aqua SCA
certifi=2024.2.2=pypi_0
requests=2.31.0=pypi_0
urllib3=2.2.1=pypi_0

Pip freeze format (supported):

# Generated by pip freeze — recognized by Aqua SCA
certifi==2024.2.2
requests==2.31.0
urllib3==2.2.1

The key differences are the use of == for version pinning and the absence of build-string suffixes.

How SCA Evaluation Works

1. 1. Manifest Detection — The scanner identifies dependency manifest files in the repository during the code scan
2. 2. Format Parsing — Each line or entry is parsed according to the manifest type's expected syntax
3. 3. Dependency Resolution — Parsed package names and versions are resolved against vulnerability databases
4. 4. Finding Generation — Known CVEs and license issues are reported as SCA findings

If parsing fails at step 2, no dependencies proceed to resolution — resulting in zero evaluated packages and zero findings.

Diagnosing Zero SCA Findings

When zero SCA findings appear unexpectedly, investigate in this order:

1. 1. Confirm a manifest file exists in the repository (check root directory and subdirectories)
2. 2. Inspect the manifest format for Conda export syntax or truncation
3. 3. Check the Dependencies tab in the Aqua console — an empty or missing dependency list indicates a parsing failure
4. 4. Add a single known package in correct pip format (for example, langflow==1.2.0) and re-scan to confirm the scanner responds to valid entries
5. 5. Compare with other repositories using similar manifest formats to determine if the issue is repository-specific

Best Practices

Manifest File Management

1. 1. Use native package manager exports — Generate requirements.txt with pip freeze, not Conda environment exports
2. 2. Commit complete dependency files — Verify the full dependency list is present before pushing; avoid truncated files
3. 3. Place manifests in discoverable locations — Root directory or standard project paths where scanners expect them
4. 4. Avoid renaming Conda exports — Do not save Conda environment dumps as requirements.txt without converting to pip format

Validating Scan Coverage Before Attestation

Before attesting a repository as free of third-party vulnerabilities:

1. 1. Confirm SCA evaluated the expected number of dependencies
2. 2. Review the Dependencies tab, not only the findings count
3. 3. Verify manifest files are in supported formats
4. 4. Cross-check SAST, Sensitive Data, and SCA coverage independently
5. 5. Re-scan after any manifest format changes and validate results

Repository Integration

1. 1. Prefer online scans — Push commits to trigger live scans rather than relying solely on offline scan results
2. 2. Monitor scan results after dependency changes — Any update to manifest files should be followed by scan verification
3. 3. Document dependency management approach — Standardize on one package manager and export format across repositories

Troubleshooting Checklist

If SCA continues to show zero findings after correcting the manifest:

• [ ] Confirmed requirements.txt uses package==version syntax (double equals)
• [ ] Removed all =pypi_0 or Conda build-string suffixes
• [ ] Verified the complete dependency list is committed (file is not truncated)
• [ ] Checked for additional manifest files (setup.py, Pipfile, pyproject.toml) that may take precedence
• [ ] Pushed changes and confirmed a new scan was triggered
• [ ] Reviewed the Dependencies tab for evaluated packages
• [ ] Confirmed no .aquaignore or scan exclusion rules block the manifest file

Configuration Examples

Correct requirements.txt Format

# requirements.txt — pip freeze format (supported)
asyncssh==2.22.0
certifi==2024.2.2
cryptography==47.0.0
langflow==1.2.0
numpy==1.26.4
requests==2.31.0
urllib3==2.2.1

Incorrect Conda Export Format

# DO NOT use this format for Aqua SCA scanning
asyncssh=2.22.0=pypi_0
certifi=2024.2.2=pypi_0
cryptography=47.0.0=pypi_0
numpy=1.26.4=pypi_0
requests=2.31.0=pypi_0

Regenerating from a Virtual Environment

# Create and activate a clean virtual environment
python -m venv .venv
source .venv/bin/activate   # Linux/macOS
# .venv\Scripts\activate    # Windows

# Install project dependencies
pip install -r requirements.txt   # or pip install from setup.py/pyproject.toml

# Export in supported format
pip freeze > requirements.txt

# Review, commit, and push
git diff requirements.txt
git add requirements.txt
git commit -m "Convert requirements.txt to pip format for SCA"
git push

Platform Coverage

Applicable To:

• Aqua SaaS Platform (Supply Chain Security)
• Code repository scanning (Azure DevOps, GitHub, GitLab, Bitbucket, and other supported integrations)

Affected Components:

• Supply Chain Security — Code Repository SCA
• Python dependency scanning (requirements.txt, setup.py, Pipfile, pyproject.toml)

Supported Languages (Context):

• Python (primary focus of this article)
• Similar manifest format requirements apply to other package managers (npm, Maven, Go modules, etc.)

Summary

Key Takeaways

1. 1. Zero SCA findings does not always mean a clean dependency tree — Confirm dependencies were actually parsed and evaluated
2. 2. Conda exports are not pip manifests — Convert Conda environment dumps to pip format before relying on SCA results
3. 3. Check the Dependencies tab — An empty dependency list indicates a parsing failure, not a clean scan
4. 4. Use pip freeze for standard exports — Ensures compatible package==version syntax
5. 5. Re-scan and validate after fixes — Confirm findings reflect actual dependency vulnerability status before attestation

Related Resources

• Aqua Supply Chain Security Documentation — Code repository scanning overview
• Code Repository Integration Guide — Connecting source control to Aqua
• SCA Scanning Overview — Software Composition Analysis capabilities