We are excited to introduce you to the latest version of Endor Labs and endorctl - v 1.6.5. This release includes several enhancements.
Command line flag changes for enhanced usability
Endor Labs has updated several flags to improve the overall usability for users. These changes are backwards compatible. All deprecated commands are hidden.
New scan options
|Scan git commits and generate findings for all dependencies.
|Leverage the power of DroidGPT to interpret build errors and generate remediation advice.
|Fetch information from GitHub, scan git commits and generate findings for all dependencies, as well as any GitHub misconfigurations.
|Scan the source code repository and generate findings for leaked secrets.
Use the flags in combination with each other to make them more use case-specific.
|Set to the git reference that you are merging to, such as your default branch. Action policies will only flag issues that do not exist in the baseline so that developers are only alerted to issues on the current changes. Example:
|Only list resources from a specific PR scan.
|Set if this is a PR scan. PR scans are not used for reporting or monitoring and should be treated as point in time policy and finding test.
|Specify a list of user-defined tags to add to the scan. Tags can be used to search and filter scans later.
|Audit the historical git logs of the repository for all branches in the repository. Must be used together with
Troubleshoot build errors with DroidGPT
Endor Labs integrates with third-party Artificial Intelligence (AI) tools to help you troubleshoot errors while performing software composition analysis, dependency resolution, or generating call graphs during an endorctl scan.
In the event of an error, DroidGPT generates explanations and actionable advice for how to resolve the error on the given host system. These suggestions are displayed as part of the error log messages on the command line and can help you understand why build errors occurred during the scan process and how to resolve them.
ImportantRecommendations generated are meant solely for informational purposes. Before implementing these suggestions, it is strongly advised to thoroughly verify and assess them to ensure their accuracy and suitability for your specific circumstances and work environments.
ENDOR_SCAN_DROID_GPT environment variable or the
--droid-gpt flag to enable DroidGPT error logging on your system.
- Enable error logging while performing a scan.
endorctl scan --droid-gpt
- Enable error logging while checking the system specifications required for performing a scan.
endorctl host-check --droid-gpt
Example: Here is an example of the recommendations generated by DroidGPT while scanning a Ruby repository where the manifest file is not correctly configured.
*** NOTE: Use the following AI-generated advice at your own risk ***
DroidGPT suggests the following as a possible remediation:
1. The error message indicates that there is a problem parsing the Gemfile, which is preventing the dependency tree from being generated.
2. Specifically, the error message states that there are no gemspecs at the specified location, which is causing Bundler to fail.
3. To fix this issue, you should check that the Gemfile is correctly configured and that all necessary gemspecs are present.
4. Additionally, you may want to try running `bundle install` to ensure that all dependencies are properly installed.
5. Please note that this advice is generated by an AI and there may be additional factors at play that are not captured in the error message. As such, there is no guarantee that these steps will resolve the issue, and you should proceed with caution.
Was this page helpful? Send your feedback to firstname.lastname@example.org