This is the multi-page printable view of this section.
Click here to print.
Return to the regular view of this page.
Scan for open source risks
Scan and detect publicly exposed open source issues posing risks to your organization.
Endor Labs supports the following major capabilities to help teams reduce the risk and expense of software dependency management across the lifecycle of software reuse.
- SCA - Software composition analysis is the identification of the bill of materials for first-party software packages and the mapping of vulnerabilities to these software component versions. SCA helps teams to maintain compliance and get visibility into the risks of their software inventory.
- Endor Scores - Endor Labs provides a holistic risk score that includes the security, quality, popularity and activity of a package. Risk scores help in identifying leading indicators of risk in addition to if a software component is outdated, or unmaintained. Risk analysis helps teams to go beyond vulnerabilities and approach the risk of their software holistically.
- Reachability Analysis - Reachability analysis is Endor Labs’ capability to perform static analysis on your software packages to give context to how each vulnerability may be reached in the context of your code. This includes mapping vulnerabilities back to vulnerable functions so that deep static analysis can target vulnerabilities with higher levels of granularity as well as the identification of unused software dependencies.
- Upgrade Impact Analysis - Upgrade impact analysis allows security teams to set better expectations with their development teams by identifying breaking changes associated with an update of a direct dependency.
The resource requirements, both minimum and recommended, for build runners or workers executing scans using endorctl are listed here.
Note: Large applications may require additional resources to complete or enhance the scan performance.
Minimum Resources
CPU |
Memory |
4 core |
16 GB RAM |
Recommended Resources
CPU |
Memory |
8 core |
32 GB RAM |
Supported languages
The following table shows Endor Labs language coverage:
Language |
SCA |
Endor Scores |
Reachability Analysis |
Upgrade Impact Analysis |
Install Toolchains |
Java |
Supported |
Supported |
Supported |
Supported |
Supported |
Python |
Supported |
Supported |
Supported |
Supported |
Supported |
Rust |
Supported |
Supported |
Supported |
Unsupported |
Supported |
JavaScript |
Supported |
Supported |
Supported * |
Unsupported |
Supported |
Golang |
Supported |
Supported |
Supported |
Unsupported |
Supported |
.NET (C#) |
Supported |
Supported |
Supported |
Unsupported |
Supported |
Kotlin |
Supported |
Supported |
Supported |
Unsupported |
Supported |
Scala |
Supported |
Supported |
Supported |
Unsupported |
Supported |
Ruby |
Supported |
Supported |
Unsupported |
Unsupported |
Unsupported |
Swift/Objective-C |
Supported |
Supported |
Unsupported |
Unsupported |
Unsupported |
PHP |
Supported |
Supported |
Unsupported |
Unsupported |
Unsupported |
* For JavaScript, reachability is currently limited to the package level; function-level reachability will be supported in the future.
Complete support matrix
The following comprehensive matrix lists the supported languages, build tools, manifest files, and supported requirements.
Language |
Package Managers / Build Tool |
Manifest Files |
Extensions |
Supported Requirements |
Java |
Maven |
pom.xml |
.java |
JDK version 11-22; Maven 3.6.1 and higher versions |
|
Gradle |
build.gradle |
.java |
JDK version 11-22; Gradle 6.0.0 and higher versions |
|
Bazel |
workspace , MODULE.bazel , BUILD.bazel |
.java |
JDK version 11-22; Bazel versions 5.x.x, 6.x.x, and 7.x.x |
Kotlin |
Maven |
pom.xml |
.kt |
JDK version 11-22; Maven 3.6.1 and higher versions |
|
Gradle |
build.gradle |
.kt |
JDK version 11-22; Gradle 6.0.0 and higher versions |
Golang |
Go |
go.mod , go.sum |
.go |
Go 1.12 and higher versions |
|
Bazel |
workspace , MODULE.bazel , BUILD.bazel |
.go |
Bazel versions 5.x.x, 6.x.x, and 7.x.x |
Rust |
Cargo |
cargo.toml , cargo.lock |
.rs |
Rust 1.63.0 and higher versions |
JavaScript |
npm |
package-lock.json , package.json |
.js |
npm 6.14.18 and higher versions |
|
pnpm |
pnpm-lock.yaml , package.json |
.js |
pnpm 3.0.0 and higher versions |
|
Yarn |
yarn.lock , package.json |
.js |
Yarn all versions |
TypeScript |
npm |
package-lock.json, package.json |
.ts |
npm 6.14.18 and higher versions |
|
pnpm |
pnpm-lock.yaml , package.json |
.ts |
pnpm 3.0.0 and higher versions |
|
Yarn |
yarn.lock , package.json |
.ts |
Yarn all versions |
Python |
pip |
requirements.txt |
.py |
Python 3.6 and higher versions; pip 10.0.0 and higher versions |
|
Poetry |
pyproject.toml , poetry.lock |
.py |
|
|
PyPI |
setup.py , setup.cfg , pyproject.toml |
.py |
|
|
Bazel |
workspace , MODULE.bazel |
.py |
Bazel versions 5.x.x, 6.x.x, and 7.x.x |
.NET (C#) |
Nuget |
*.csproj , package.lock.json , projects.assets.json , Directory.Build.props , Directory.Packages.props , *.props |
.cs |
.NET 1.0 and higher versions |
Scala |
sbt |
build.sbt |
.sc or .scala |
sbt 1.3 and higher versions |
|
Bazel |
workspace , MODULE.bazel |
.sc or .scala |
Bazel versions 5.x.x, 6.x.x, and 7.x.x |
Ruby |
Bundler |
Gemfile , *.gemspec , gemfile.lock |
.rb |
Ruby 2.6 and higher versions |
Swift/Objective-C |
CocoaPods |
Podfile , Podfile.lock |
.swift , .h , .m |
CocoaPods 0.9.0 and higher versions |
PHP |
Composer |
composer.json , composer.lock |
.php |
PHP 5.3.2 and higher versions; Composer 2.2.0 and higher versions |
Important
To successfully execute the endorctl scan for your languages, your repository must include at least one of the following language-specific file extensions: .java
, .kt
, .go
, .rs
, .js
, .ts
, .py
, .cs
, .sc
, .scala
, .rb
, .swift
, .h
, .m
, .php
.
See the detailed procedure for all supported languages:
1 - Java
Learn how to implement Endor Labs in repositories with Java packages.
Java is a high-level, object-oriented programming language widely used by developers. Endor Labs supports scanning and monitoring of Java projects.
Using Endor Labs, developers can:
- Test their software for potential issues and violations of organizational policy
- Prioritize vulnerabilities in the context of their applications
- Understand the relationships between software components in their applications
Scan Java projects
To successfully scan your Java applications:
- Install software prerequisites
- Build your Java projects
- Run a scan
- Understand the scan process
- Troubleshoot errors
Install software prerequisites
- Endor Labs requires the following pre-requisite software to be installed to successfully perform a scan:
- Make sure your repository includes one or more files with
.java
extension.
- When performing deep scans make sure that you have the following minimum system specification requirements:
- 4-core processor with 16 GB RAM for small projects
- 8-core processor with 32 GB RAM for mid-size projects
- 16-core processor with 64 GB RAM for large projects
Build Java projects
You must build your Java projects before running a scan. Additionally, ensure that the packages are downloaded into the local package caches and that the build artifacts are present in the standard locations.
Use Gradle
To analyze your software built with Gradle, Endor Labs requires that the software be able to be successfully built. To perform a quick scan, dependencies must be located in the local package manager cache. The standard $GRADLE_USER_HOME/caches or /User/<username>/.gradle/caches
must exist and contain successfully downloaded dependencies. To perform a deep scan the target artifact must be generated on the filesystem as well.
To build your project with Gradle, use the following procedure:
-
If you would like to run a scan against a custom configuration, specify the Gradle configuration by setting an environment variable.
export endorGradleJavaConfiguration="<configuration>"
The default configuration is runtimeClasspath
if none is provided.
-
Ensure that you can resolve the dependencies for your project without errors by running the following command:
For Gradle wrapper:
For Gradle:
-
Run ./gradlew assemble
or gradle assemble
to resolve dependencies and to create an artifact that may used for deep analysis.
Override sub project level configuration
In a multi-build project, if you set the environment variable endorGradleJavaConfiguration=[GlobalConfiguration]
, the specified configuration is used for dependency resolution across all projects and sub-projects in the hierarchy below.
\--- Project ':samples'
+--- Project ':samples:compare'
+--- Project ':samples:crawler'
+--- Project ':samples:guide'
+--- Project ':samples:simple-client'
+--- Project ':samples:slack'
+--- Project ':samples:static-server'
+--- Project ':samples:tlssurvey'
\--- Project ':samples:unixdomainsockets'
To override the configuration only for the :samples:crawler
and :samples:guide
sub-projects, follow these steps:
-
Navigate to the root workspace, where you execute endorctl scan
, and run ./gradlew projects
to list all projects and their names.
-
Run the following command at the root of the workspace:
echo ":samples:crawler=testRuntimeClasspath,:samples:guide=macroBenchMarkClasspath" >> .endorproperties
This creates a new file named .endorproperties
in your root directory. This enables different configurations for the specified sub-projects in the file.
-
Run endorctl scan
as usual.
At this point, all other projects will adhere to the GlobalConfiguration
. However, the :samples:crawler
sub-project will use the testRuntimeClasspath
configuration, and the :samples:guide
sub-project will use the macroBenchMarkClasspath
configuration.
Use Maven
To analyze your software built with Maven, Endor Labs requires that the software be able to be successfully built. To perform a quick scan, dependencies must be located in the local package manager cache. The standard .m2 cache must exist and contain successfully downloaded dependencies. To perform a deep scan the target artifact must be generated on the filesystem as well.
To build your project with Maven, use the following procedure:
-
Ensure that you can resolve the dependencies for your project without error by running the following command.
-
Run mvn install
and make sure the build is successful.
info
If you want to skip the execution of tests during the build, you can use -DskipTests
to quickly build and install your projects.
-
If you have multiple Java modules not referenced in the root pom.xml file, make sure to run mvn install
separately in all the directories.
If you have a private registry and internal dependencies on other projects, you must configure private registries. In addition to scanning public Java projects and repositories, Endor Labs provides the support to integrate with private registries.
- Sign in to Endor Labs and select Integrations under Manage from the left sidebar.
- From Package Managers, select Maven and click Manage.
- Click Add Package Manager.
- Enter a package manager URL.
- To enable Endor Labs to authenticate to your registry, select Authenticate to this registry and enter the username and password of your private package manager repository.
- Click Add Package Manager to save your configuration.
Run a scan
Use the following options to scan your repositories. Perform a scan after building the projects.
Option 1 - Quick scan
Perform a quick scan to get quick visibility into your software composition. This scan won’t perform reachability analysis to help you prioritize vulnerabilities.
endorctl scan --quick-scan
You can perform the scan from within the root directory of the Git project repository, and save the local results to a results.json file. The results and related analysis information are available on the Endor Labs user interface.
endorctl scan --quick-scan -o json | tee /path/to/results.json
You can sign into the Endor Labs user interface, click the Projects on the left sidebar, and find your project to review its results.
Option 2 - Deep scan
Use the deep scan to perform dependency resolution, reachability analysis, and generate call graphs. You can do this after you complete the quick scan successfully.
Use the following flags to save the local results to a results.json file. The results and related analysis information are available on the Endor Labs user interface.
endorctl scan -o json | tee /path/to/results.json
When deep analysis is performed all private software dependencies are completely analyzed by default if they have not been previously scanned. This is a one-time operation and will slow down initial scans, but won’t impact subsequent scans.
Organizations might not own some parts of the software internally and the related findings are not actionable by them. They can choose to disable this analysis using the flag disable-private-package-analysis
. By disabling private package analysis, teams can enhance scan performance but may lose insights into how applications interact with first-party libraries.
Use the following command flag to disable private package analysis:
endorctl scan --disable-private-package-analysis
You can sign into the Endor Labs user interface, click the Projects on the left sidebar, and find your project to review its results.
Scan the projects on JDK version 8
Endor Labs supports JDK versions between 11-22, however, you can scan projects on JDK 8 using the following procedure:
-
Build your Java project on JDK 8.
-
After building, switch your Java home to JDK 11 or higher versions.
export JAVA_HOME=/Library/Java/JavaVirtualMachines/openjdk-11.jdk/Contents/Home
-
Run a scan
Scan projects on Gradle versions between 4.7 and 6.0.0
To scan Java projects on Gradle versions between 4.7 and 6.0.0, make sure to
-
Check the version of your project using:
-
The project must have a Gradle wrapper. You can generate the Gradle wrapper using:
--gradle-version <your required version>.
Endor Labs prioritizes Gradle wrapper over Gradle and it is a recommended best practice to use Gradle Wrapper.
-
Before executing the endorctl scan, ensure the project can be built in your required version.
Execute ./gradlew assemble.
-
Use --bypass-host-check
during endorctl scan to execute scans on projects that have Gradle versions lower than 6.0.0.
Understand the scan process
Endor Labs analyzes your Java code and dependencies to detect known security issues, including open-source vulnerabilities and generates call graphs.
How Endor Labs resolves dependencies for package versions
Endor Labs resolves the dependencies for Java packages based on the following factors:
- For packages built using Maven, it leverages the Maven cache in the .m2 directory of your file system to resolve the package’s dependencies and mirrors Maven’s build process for the most accurate results.
- For Maven, Endor Labs respects the configuration settings present in the settings.xml file. If this file is included in your repository, you need not provide any additional configuration.
- For packages built using Gradle, it uses Gradle and Gradle wrapper files to build packages and resolve dependencies.
- Endor Labs supports EAR, JAR, RAR, and WAR files.
Endor Labs performs static analysis on the Java code based on the following factors:
- Call graphs are created for your package. These are then combined with the call graphs of the dependencies in your dependency tree to form a comprehensive call graph for the entire project.
- Endor Labs performs an inside-out analysis of the software to determine the reachability of dependencies in your project.
- The static analysis time may vary depending on the number of dependencies in the package and the number of packages in the project.
Known limitations
- If a package can not be successfully built in the source control repository, static analysis will fail.
- Spring dependencies are analyzed based on spring public entry points to reduce the impact of Inversion of Control (IOC) frameworks. Dependencies and functions are identified as reachable and unreachable in the context of a spring version and its entry points.
- Annotation processing is limited only to the usage of the code they annotate.
- Static analysis of reflection and callbacks are not supported.
- Endor Labs requires JDK 11 to generate call graphs for Java projects. Gradle versions lacking JDK 11 support are not compatible.
Troubleshoot errors
Here are a few error scenarios that you can check for and attempt to resolve them.
-
Host system check failure errors:
- Java is not installed or not present in the PATH environment variable. Install Java and try again. See Java documentation for more information.
- The installed version of Java is lower than the required version. Install JDK versions between 11-22 and try again.
- Java is installed but Maven or Gradle is not installed. In such cases, the dependency resolution may not be complete.
-
Unresolved dependency errors:
Maven is not installed properly or the system is unable to build root pom.xml. Run mvn dependency:tree
in the root of the project and try again. In such cases, the dependency resolution may not be complete.
-
Resolved dependency errors:
A version of a dependency does not exist or it cannot be found. It may have been removed from the repository.
-
Gradle variant incompatibility message:
Gradle performs JVM toolchain checks for sub projects or dependencies and may raise errors indicating a Java version mismatch between dependencies declared in Gradle manifest and Java home setup.
Example error message:
Incompatible because this component declares a component for use during compile-time, compatible with Java version 21 and the consumer needed a component for use during runtime, compatible with Java version 17
- To resolve this and taking advantage of Java’s backward compatibility, instruct Gradle to use the higher version of JDK detected in the error message. For example, for the message above, specify org.gradle.java.home=<path of java>
in .gradle/gradle.properties
.
The path needs to be to the root of the directory bin/java
. For example, if your Java is at /Users/Downloads/jdk-21/Contents/Home/bin/java
, specify org.gradle.java.home=/Users/Downloads/jdk-21/Contents/Home
.
- If you are scanning a purely Java 8 Gradle project and if you encounter the above error, set org.gradle.java.home
to point to Java 8 home, before you execute the endorctl scan.
- A general guideline for determining which Java version to use, is to match the Java version specified in .gradle
/gradle.properties
with the one used for building your Gradle project.
-
Call graph errors:
- The project can not be built because a dependency cannot be located in the repository.
- Sometimes, the project is not built, if a Java version discrepancy exists between the required repository version and the version on the system running the scan. For example, the Java required version is 1.8 but the system has 12 installed. Install the required version and try again.
-
If you have a private registry and internal dependencies on other projects, you must configure the credentials of the registry. See Configure Maven private registries.
-
If you have a large repository, you may need to increase the size of the JVM through a scan parameter. Export the ENDOR_SCAN_JVM_PARAMETERS
environment variable with additional JVM parameters before performing the scan as shown below:
export ENDOR_SCAN_JVM_PARAMETERS="-Xmx32G"
-
If you use a remote repository configured to authenticate with a client-side certificate, you must add the certificate through an endorctl parameter. Export the ENDOR_SCAN_JVM_PARAMETERS
parameter before performing a scan. See Maven documentation for details.
export ENDOR_SCAN_JVM_PARAMETERS="-Xmx16G,-Djavax.net.ssl.keyStorePassword=changeit,
-Djavax.net.ssl.keyStoreType=pkcs12,
-Djavax.net.ssl.keyStore=/Users/myuser/Documents/nexustls/client-cert1.p12"
2 - Kotlin (Beta)
Learn how to implement Endor Labs in repositories with Kotlin packages.
Kotlin is a statically typed programming language that runs on the Java Virtual Machine (JVM), known for its concise syntax, null safety, and seamless integration with Java. Endor Labs supports scanning and monitoring of Kotlin projects.
Using Endor Labs, developers can:
- Test their software for potential issues and violations of organizational policy
- Prioritize vulnerabilities in the context of their applications
- Understand the relationships between software components in their applications
Scan Kotlin projects
To successfully scan your Kotlin projects:
- Prerequisites
- Build your Kotlin projects
- Run a scan
- Understand the scan process
Prerequisites
-
Install software: To ensure a successful scan using Endor Labs, it is essential to have the following prerequisite software installed:
-
Maven Package Manager: Version 3.6.1 and higher
-
Gradle Build System: Version 6.0.0 and higher
-
Java Runtime Environment: JDK versions between 11 and 19
-
Kotlin: version 1.4 through 1.9.x
For users on JDK 8, specific instructions can be found in the section Scan the Projects on JDK Version 8.
-
Make sure your repository includes one or more files with .kt
extension.
-
Minimum system specifications for deep scans: When performing deep scans, ensure that you have the following minimum system specifications:
- For small projects: 4-core processor with 16 GB RAM
- For mid-size projects: 8-core processor with 32 GB RAM
- For large projects: 16-core processor with 64 GB RAM
Build Kotlin projects
Before initiating a scan with Endor Labs, ensure that your Kotlin projects are built successfully. Additionally, ensure that the packages are downloaded into local package caches and build artifacts are present in their standard locations. Follow the guidelines to use Gradle and Maven:
Use Gradle
To analyze your software built with Gradle, Endor Labs requires:
- The software must be successfully built with Gradle.
- For quick scans, dependencies must be located in the local package manager cache. The standard
$GRADLE_USER_HOME/caches or /User/<<username>>/.gradle/caches
cache must exist.
- For deep scans, the target artifact must be generated on the filesystem.
To build your project with Gradle, run the following commands:
- Specify the Gradle configuration by setting an environment variable.
export endorGradleKotlinConfiguration="compileClasspath"
If you need to override the default configuration, use the command:
export endorGradleKotlinConfiguration="<configuration>"
The default configuration is `runtimeClasspath` if none is provided.
For Android projects, you can set the configuration using:
export endorGradleAndroidConfiguration="<configuration>"
The default configuration for an Android application or library uses the same structure established by Android Studio. For applications, all possible combinations of application variants are examined. For libraries, all possible combinations of library variants are examined. The first variant from the alphabetically sorted list is then selected for runtimeClasspath
.
If neither approach provides a value, the default configuration is set to releaseRuntimeClasspath
.
- Confirm an error-free dependency resolution for your project.
or, with a Gradle wrapper.
- Generate the artifact for deep analysis.
or, with a Gradle wrapper.
Override sub project level configuration
In a multi-build project, if you set the environment variable endorGradleKotlinConfiguration=[GlobalConfiguration]
and/or endorGradleAndroidConfiguration=[GlobalConfiguration]
, the specified configuration is used for dependency resolution across all projects and sub-projects in the hierarchy below.
\--- Project ':samples'
+--- Project ':samples:compare'
+--- Project ':samples:crawler'
+--- Project ':samples:guide'
+--- Project ':samples:simple-client'
+--- Project ':samples:slack'
+--- Project ':samples:static-server'
+--- Project ':samples:tlssurvey'
\--- Project ':samples:unixdomainsockets'
To override the configuration only for the :samples:crawler
and :samples:guide
sub-projects, follow these steps:
-
Navigate to the root workspace, where you execute endorctl scan
, and run ./gradlew projects
to list all projects and their names.
-
Run the following command at the root of the workspace:
echo ":samples:crawler=testRuntimeClasspath,:samples:guide=macroBenchMarkClasspath" >> .endorproperties
This creates a new file named .endorproperties
in your root directory. This enables different configurations for the specified sub-projects in the file.
- Run
endorctl scan
as usual.
At this point, all other projects will adhere to the GlobalConfiguration
. However, the :samples:crawler
sub-project will use the testRuntimeClasspath
configuration, and the :samples:guide
sub-project will use the macroBenchMarkClasspath
configuration.
Use Maven
To analyze your software built with Maven, Endor Labs requires:
- The software must be successfully built with Maven.
- For quick scans, dependencies must be located in the local package manager cache. The standard
.m2
cache must exist.
- For deep scans, the target artifact must be generated on the filesystem.
To build your project with Maven, run the following commands:
- Confirm an error-free dependency resolution for your project.
-
Run mvn install
and ensure the build is successful.
info
If you want to skip the execution of tests during the build, you can use -DskipTests
to quickly build and install your projects.
- If you have multiple Kotlin modules not referenced in the root pom.xml file, ensure to run
mvn install
separately in each directory.
If you have a private registry with internal dependencies on other projects, you must configure private registries. Endor Labs not only supports scanning public Kotlin projects and repositories but also allows integration with private registries.
Follow these steps to configure Maven private registries:
- Sign in to Endor Labs and navigate to Integrations under Manage from the left sidebar.
- In the Package Managers > Maven section, click Manage.
- On the Maven integrations page, click Add Package Manager.
- Specify a package manager URL.
- (Optional) To enable Endor Labs to authenticate to your registry, select Authenticate to this registry and specify the username and password of your private package manager repository.
- Click Add Package Manager to save your configuration.
Run a scan
To scan your repositories with Endor Labs, you can use the following options after building your Kotlin projects.
Option 1 - Quick scan
To quickly gain insight into your software composition, initiate a quick scan using the following command:
endorctl scan --quick-scan
This scan offers a quick overview without performing reachability analysis, helping you prioritize vulnerabilities.
Save local results
To scan a Git project repository from the root directory and save the results locally in the results.json file, use the following command:
endorctl scan --quick-scan -o json | tee /path/to/results.json
This generates comprehensive results and analysis information, accessible from the Endor Labs user interface.
Access results
To access and review detailed results, sign in to the Endor Labs user interface. Navigate to Projects on the left sidebar, and locate your project for a thorough examination of the scan results.
Option 2 - Deep scan
To perform dependency resolution and reachability analysis, use deep scan with Endor Labs. This option is recommended only after successfully completion of quick scan.
Save local scan results
To save the local results to a results.json file, use the following flag.
endorctl scan -o json | tee /path/to/results.json
This generates comprehensive results and analysis information, accessible from the Endor Labs user interface.
Analyze private packages
During deep analysis, Endor Labs thoroughly analyzes all private software dependencies that have not been previously scanned. While this initial operation may slow down scans, subsequent scans remain unaffected.
If your organization does not own specific software parts and related findings are non-actionable, you can choose to disable this analysis using the disable-private-package-analysis
flag. Disabling private package analysis enhances scan performance but may result in a loss of insights into how applications interact with first-party libraries.
To disable private package analysis, use the following command flag:
endorctl scan --disable-private-package-analysis
Access scan results
To access and review detailed results, sign in to the Endor Labs user interface. Navigate to Projects on the left sidebar, and locate your project for a thorough examination of the scan results.
Scan the projects on JDK version 8
While Endor Labs primarily supports JDK versions between 11-22, you can still scan projects on JDK 8 by following these steps:
- Build your Java project on JDK 8.
- After successful build, switch your Java home to JDK 11 or higher versions.
export JAVA_HOME=/Library/Java/JavaVirtualMachines/openjdk-11.jdk/Contents/Home
- Run a scan.
Understand the scan process
Endor Labs analyzes your Kotlin code and dependencies to identify known security issues, including open-source vulnerabilities.
How Endor Labs resolves dependencies for package versions
Endor Labs resolves Kotlin package dependencies by considering the following factors:
- For packages built with Maven, it leverages the Maven cache in the
.m2
directory of your file system. This mirrors Maven’s build process for precise results.
- For packages built with Maven, it respects the configuration settings present in the settings.xml file. If the file is included in your repository, any additional configuration is not necessary.
- For packages built with Gradle, it leverages Gradle and Gradle wrapper files to build and resolve dependencies.
- Endor Labs supports AAR, EAR, JAR, RAR, and WAR files.
Endor Labs performs static analysis on the code based on the following factors:
- Call graphs are created for your package. These are then combined with the call graphs of the dependencies in your dependency tree to form a comprehensive call graph for the entire project.
- Endor Labs performs an inside-out analysis of the software to determine the reachability of dependencies in your project.
- The static analysis time may vary depending on the number of dependencies in the package and the number of packages in the project.
Known limitations
- If a package can not be successfully built in the source control repository, static analysis will fail.
- Spring dependencies are analyzed based on spring public entry points to reduce the impact of Inversion of Control (IOC) frameworks. Dependencies and functions are identified as reachable and unreachable in the context of a spring version and its entry points.
- Annotation processing is limited only to the usage of the code they annotate.
- Static analysis of reflection and callbacks are not supported.
- If Endor Labs fails to resolve dependencies using default Kotlin configurations, the Kotlin configuration must be specified.
- Static analysis for Kotlin projects using Gradle is only supported when the Kotlin plugin for Gradle versions 1.5.30 to 1.9.x
Troubleshoot errors
Here are a few error scenarios that you can check for and attempt to resolve them.
- Host system check failure errors:
- Java is not installed or not present in the PATH environment variable. Install Java and try again. See Java documentation for more information.
- For android applications, $ANDROID_HOME must be specified as an environment variable.
- The installed version of Java is lower than the required version. Install JDK versions between 11-22 and try again.
- Java is installed but Maven or Gradle is not installed. In such cases, the dependency resolution may not be complete.
- Unresolved dependency errors:
Maven is not installed properly or the system is unable to build root pom.xml. Run
mvn dependency:tree
in the root of the project and try again. In such cases, the dependency resolution may not be complete.
- Resolved dependency errors:
A version of a dependency does not exist or it cannot be found. It may have been removed from the repository.
- Call graph errors:
- If the project is not compiled, call graphs are not generated. Run
gradlew compileKotlin
or gradlew compileReleaseKotlin
for android based projects before running the scan.
- Sometimes, the project is not compiled, if a Kotlin version discrepancy exists between the required repository version and the version on the system running the scan. For example, the Kotlin required version is 1.4 but the system has lower version installed. Install the required version and try again.
- If you have a private registry and internal dependencies on other projects, you must configure the credentials of the registry. See Configure Maven private registries.
- If you use a remote repository configured to authenticate with a client-side certificate, you must add the certificate through an endorctl parameter. Export the
ENDOR_SCAN_JVM_PARAMETERS
parameter before performing a scan. See Maven documentation for details.
export ENDOR_SCAN_JVM_PARAMETERS="-Xmx16G,-Djavax.net.ssl.keyStorePassword=changeit,
-Djavax.net.ssl.keyStoreType=pkcs12,
-Djavax.net.ssl.keyStore=/Users/myuser/Documents/nexustls/client-cert1.p12"
3 - Go
Learn how to implement Endor Labs in repositories with Go packages.
Go or Golang is a software development programming language widely used by developers. Endor Labs supports scanning and monitoring of Go projects.
Using Endor Labs, developers can:
- Test their software for potential issues and violations of organizational policy
- Prioritize vulnerabilities in the context of their applications
- Understand the relationships between software components in their applications
Scan Go projects
To successfully scan your repositories for Go:
Install software prerequisites
- Make sure that you have Go 1.12 or higher versions.
- Make sure your repository includes one or more files with
.go
extension.
Build Go projects
You must build your Go projects before running the scan. Additionally, ensure that the packages are downloaded into the local package caches and that go.mod file well formed and is available in the standard location.
To ensure that your go.mod file is well formed, run the following command:
This removes any dependencies that are not required by your project and ensures to resolve the dependencies without errors.
Run a scan
Use the following options to scan your repositories. Perform the endorctl scan after building the projects.
Option 1 - Quick scan
Perform a quick scan to get quick visibility into your software composition. This scan won’t perform reachability analysis to help you prioritize vulnerabilities.
endorctl scan --quick-scan
You can perform the scan from within the root directory of the Git project repository, and save the local results to a results.json file. The results and related analysis information are available on the Endor Labs user interface.
endorctl scan --quick-scan -o json | tee /path/to/results.json
You can sign into the Endor Labs user interface, click the Projects on the left sidebar, and find your project to review its results.
Option 2 - Deep scan
Use the deep scan to perform dependency resolution, reachability analysis, and generate call graphs. You can do this after you complete the quick scan successfully.
Use the following flags to save the local results to a results.json file. The results and related analysis information are available on the Endor Labs user interface.
endorctl scan -o json | tee /path/to/results.json
You can sign into the Endor Labs user interface, click the Projects on the left sidebar, and find your project to review its results.
Understand the scan process
Endor Labs resolves your Golang-based dependencies by leveraging built-in Go commands to replicate the way a package manager would install your dependencies.
To discover package names for Go packages Endor Labs uses the command:
go list -e -mod readonly -json -m
To analyze the dependency graph of your package Endor Labs uses the command:
go list -e -deps -json -mod readonly all
To assess external dependencies, specifically third-party packages or libraries that your Go project relies on, Endor Labs uses the command:
go list -e -deps -json -mod vendor all
These commands allow us to assess packages’ unresolved dependencies, analyze the dependency tree, and resolve dependencies for your Go projects.
Known Limitations
Endor Labs creates go.mod files for you when projects do not have a go.mod file. This can lead to inconsistencies with the actual package created over time and across versions of the dependencies.
Troubleshoot errors
Here are a few error scenarios that you can check for and attempt to resolve them.
-
Host system check failure errors:
- Go is not installed or not present in the PATH environment variable. Install Go and try again.
- The installed version of Go is lower than 1.12. Install Go version 1.12 or higher and try again.
-
Resolved dependency errors:
- A version of a dependency does not exist or it cannot be found. It may have been removed from the repository.
- If the go.mod file is not well-formed then dependency resolution may return errors. Run
go mod tidy
and try again.
-
Call graph errors:
These errors often mean the project won’t build. Please ensure any generated code is in place and verify that go build ./...
runs successfully.
4 - Python
Learn how to implement Endor Labs in repositories with Python packages.
Python is a high-level, interpreted programming language widely used by developers. Endor Labs supports the scanning and monitoring of Python projects.
Using Endor Labs, developers can:
- Test their software for potential issues and violations of organizational policy
- Prioritize vulnerabilities in the context of their applications
- Understand the relationships between software components in their applications
Scan Python projects
To successfully scan your repositories for Python:
- Install software prerequisites
- Build Python projects
- Run a scan
- Understand the scan process
- Troubleshoot errors
Software prerequisites
Ensure that the following prerequisites are complete:
- Install Python 3.6 or higher versions. See the Python documentation on how to install Python.
- Ensure that the package manager pip, Poetry, or PDM is used by your projects to build your software packages. From Python 3.12, install setuptools if you use pip.
- Set up any build, code generation, or other dependencies that are required to install your project’s packages.
- Organize the project as one or more packages using
setup.py
, setup.cfg
, pyproject.toml
, or requirements.txt
package manifest files.
- Make sure your repository includes one or more files with
.py
extension or pass either one of requirements.txt
, setup.py
, setup.cfg
or pyproject.toml
using the --include
flag.
Hardware Prerequisites
Make sure that you meet the following minimum system specifications.
Repository size |
Processor |
Memory |
Small |
8-core |
32 GB |
Medium |
16-core |
64 GB |
Large |
32-core |
128 GB |
Build Python projects
You must create a virtual environment and build your Python projects before running the endorctl scan. Additionally, ensure that the packages are downloaded into the local package caches and that the build artifacts are present in the standard locations.
- Configure any private repositories
- If you use dependencies from a PyPI compatible repository other than
pypi.org
, configure it in the Integrations section of the Endor Labs web application. See Configure Python private repositories for more details.
- Clone the repository and create a virtual environment inside it
-
Clone the repository using git clone
or an equivalent workflow.
-
Enter the working copy root directory that’s created.
-
Create a virtual environment based your package manager:
For pip or setuptools
- Use
python3 -m venv venv
. Set up the virtual environment in the root folder that you want to scan and name it venv
or .venv
.
- Install your project’s dependencies using
venv/bin/python -m pip install -r requirements.txt
or venv/bin/python -m pip install
.
- If the virtual environment is created outside the project, use one of the ways defined in Virtual environment support to specify the path of the Python virtual environment to Endor Labs.
For Poetry projects
- Install your project’s dependencies using
poetry install
.
For PDM projects
- Install your project’s dependencies using
pdm sync
.
Virtual environment support
For Poetry and PDM, virtual environments endorctl automatically picks the virtual environments.
For pip, you need to use one of the following ways to specify the virtual environment details of your Python projects for both quick and deep scans.
- Set up the virtual environment in the root folder that you want to scan and name it venv or .venv, it is automatically picked up by the Endor Labs application.
export PYTHONPATH=/usr/tmp/venv:/usr/tmp/another-venv
- Set the environment variable
ENDOR_SCAN_PYTHON_VIRTUAL_ENV
to the path of the virtual environment of your Python project.
export ENDOR_SCAN_PYTHON_VIRTUAL_ENV=/usr/tmp/venv
- Set the environment variable
ENDOR_SCAN_PYTHON_GLOBAL_SITE_PACKAGES
to true to indicate that a virtual environment is not present and Endor Labs can use the system-wide Python installation packages and modules.
export ENDOR_SCAN_PYTHON_GLOBAL_SITE_PACKAGES=true
Note
Setting both ENDOR_SCAN_PYTHON_VIRTUAL_ENV
and ENDOR_SCAN_PYTHON_GLOBAL_SITE_PACKAGES
environment variables at the same time is currently not supported, and the scan may not be successful.
If you do not set up the virtual environment, Endor Labs attempts to set it up with all the code dependencies, however, we recommend that you install all dependencies in a virtual environment for the most accurate results.
If you are using custom scripts without manifest files to assemble your dependencies, make sure to set up the virtual environment and install the dependencies.
In addition to scanning public Python projects, Endor Labs provides support to fetch and scan private Python repositories. Endor Labs will fetch the resources from the authenticated endpoints and perform the scan, and you can view the dependencies and findings.
- Sign in to Endor Labs and select Integrations under Manage from the left sidebar.
- From Package Managers, select PyPI and click Manage.
- Click Add Package Manager.
- Enter a package manager URL.
- To enable Endor Labs to authenticate to your registry, select Authenticate to this registry and enter the username and password of your private package manager repository.
- Click Add Package Manager to save your configuration.
Run a scan
Use the following options to scan your repositories. Perform the endorctl scan after building the projects.
Option 1 - Quick scan
Perform a quick scan to get quick visibility into your software composition and perform dependency resolution. It discovers dependencies that the package has explicitly declared. If the package’s build file is incomplete then the dependency list will also be incomplete. This scan won’t perform reachability analysis to help you prioritize vulnerabilities.
endorctl scan --quick-scan
You can perform the scan from within the root directory of the Git project repository, and save the local results to a results.json file. The results and related analysis information are available on the Endor Labs user interface.
endorctl scan --quick-scan -o json | tee /path/to/results.json
You can sign in to the Endor Labs user interface, click the Projects on the left sidebar, and find your project to review its results.
Option 2 - Deep scan
Use the deep scan to perform dependency resolution, reachability analysis, and generate call graphs. You can do this after you complete the quick scan successfully.
The deep scan performs the following operations for the Python projects.
- Discovers explicitly declared dependencies,
- Discovers project dependent OSS packages present in the
venv/global
and scope/python
.
- Performs reachability analysis and generates call graphs.
- Detects dependencies used in source code but not declared in the package’s manifest files called
phantom dependencies
.
Use the following flags to save the local results to a results.json file. The results and related analysis information are available on the Endor Labs user interface.
endorctl scan -o json | tee /path/to/results.json
When a deep scan is performed all private software dependencies are completely analyzed by default if they have not been previously scanned. This is a one-time operation and will slow down initial scans, but won’t impact subsequent scans.
Organizations might not own some parts of the software internally and the related findings are not actionable by them. They can choose to disable this analysis using the flag disable-private-package-analysis
. By disabling private package analysis, teams can enhance scan performance but may lose insights into how applications interact with first-party libraries.
You can sign in to the Endor Labs user interface, click the Projects on the left sidebar, and find your project to review its results.
Understand the scan process
Endor Labs uses the following two methods to analyze your Python code.
Endor Labs uses the results from both these methods to perform superior dependency resolution, identify security issues, detect open-source vulnerabilities, and generate call graphs.
Dependency resolution using manifest files
In this method, Endor Labs analyzes the manifest files present in a project to detect and resolve dependencies. The manifest files are analyzed in the following priority.
Package Manager |
Priority |
Build Solution |
Poetry |
1 |
poetry.lock |
|
|
pyproject.toml |
PDM |
2 |
pdm.lock |
|
|
pyproject.toml |
pip |
3 |
setup.py |
|
|
setup.cfg |
|
|
pyproject.toml |
|
|
requirements.txt |
For Poetry and pip, if both lock
and toml
files are available, both are analyzed based to detect and resolve dependencies.
For pip, the dependency resolution is as follows, where the first available file in the priority list is analyzed to detect and resolve dependencies, and others are ignored.
Build solution |
Priority |
setup.py |
1 |
setup.cfg |
2 |
pyproject.toml |
3 |
requirements.txt |
4 |
On initialization of a scan, Endor Labs identifies the package manager by inspecting files such as the pyproject.toml
, poetry.lock
, pdm.lock
, setup.py
, and requirements.txt
. When the files, poetry.lock
or pyproject.toml
files are discovered, Endor Labs will use the Poetry package manager to build the project. When the files, pdm.lock
or pyproject.toml
files are discovered, Endor Labs will use the PDM package manager. Otherwise, it will use pip3.
Example
This is an example that demonstrates scanning a Python repository from GitHub on your local system using the endorctl scan.
Here we are assuming that you are running the scan on a Linux or Mac operating system environment and that you have the following Endor Labs API key and secret stored in the environment variables. See endorctl flags and variables.
ENDOR_API_CREDENTIALS_KEY
set to the API key
ENDOR_API_CREDENTIALS_SECRET
set to the API secret
ENDOR_NAMESPACE
set to your namespace (you can find this when logged into Endor Labs by looking at your URL: https://app.endorlabs.com/t/NAMESPACE/...
; it is typically a form of your organization’s name)
pip
git clone https://github.com/HybirdCorp/creme_crm.git
cd creme_crm
python3 -m venv venv
source venv/bin/activate
venv/bin/python3 -m pip install
endorctl scan
Poetry
git clone https://github.com/HybirdCorp/creme_crm.git
cd creme_crm
poetry lock
endorctl scan
PDM
git clone https://github.com/HybirdCorp/creme_crm.git
cd creme_crm
pdm sync
endorctl scan
The scan for this repository is expected to be completed in a few minutes depending on the size of the project.
You can now visit app.endorlabs.com, navigate to Projects, and choose the helloflas/flask-examples project to see your scan results.
Dependency resolution using static analysis
All Python projects do not always include manifest files. A project can be a series of install statements that are assembled by custom scripts. Even when manifest files are present, the dependency information and version declared in the manifest file may be drastically different from what is used in a project.
To solve this problem, Endor Labs has developed a unique method for dependency resolution by performing a static analysis on the code, giving you complete visibility of what is used in your code.
- Endor Labs enumerates all Python packages and recognizes the import statements within the project. An import statement is a Python code statement that is used to bring external modules or libraries into your Python script.
- It performs a static analysis of the code to match the import statements with the pre-installed packages and recursively traverses all files to create a dependency tree with the actual versions that are installed in the virtual environment.
- It detects the dependencies at the system level to identify which ones are resolved and retrieves the precise name and version information from the library currently in use.
- Also, it gives you accurate visibility into your project components and helps you understand how the components depend on one another.
Through this approach, Endor Labs conducts comprehensive dependency management, assesses reachability, and generates integrated call graphs.
Note
Dependency resolution using static analysis is performed on deep scans only.
Known Limitations
- Endor Labs specifically looks for the requirements.txt file for a Python project using pip. If you use a different file name, it won’t be automatically discovered.
- Python versions older than 3.7 are not supported but may work as expected.
- If a virtual environment is not provided, Python version constraints are not assumed based on the runtime environment of CI. Dependencies are shown for all possible versions of Python at runtime. If a virtual environment is provided, Endor Labs respects what is installed in the virtual environment.
- Symbolic links into manifest files may result in the same package being duplicated in the project.
- If a dependency is not available in the PyPI repository or in a configured private package repository, Endor Labs will be unable to build the software and scans may fail without first building the package in the local environment successfully.
Call Graph Limitations
- Function calls using dispatch table calls might not be included in the call graph.
- Function calls using unresolved variables might not be included in the call graph.
- Dynamically modified or extended function calls used to declare methods or attributes at run time might not be included in the call graph.
- Functions called indirectly through a function pointer and not by their direct name, might not be included in the call graph.
- Type stubs that provide hints or type annotations for functions, methods, and variables in your Python modules or libraries have to be installed manually before performing a scan.
- If your project has a
pyproject.toml
file that includes tools.pyright
section, it overrides Endor Labs settings for Pyright and may result in incorrect call graph results. You will need to remove the tools.pyright
section from the pyproject.toml
file.
Troubleshoot errors
Here are a few error scenarios that you can check for and attempt to resolve them.
- Virtual environment errors: You can identify the errors that may occur during virtual environment installation by looking for the following message in the error logs;
failed to create virtual environment or failed to install dependencies.
- Missing environment dependency: If your code depends on packages such as psycopg2, environment dependencies such as PostgreSQL are also required. The endorctl scan may fail if the environment where it is running does not have PostgreSQL installed.
- Incompatible Python version: The default Python version in the environment where the endorctl scan is running is incompatible with one or more of the dependencies that are needed by the code.
- Incompatible architecture: One or more dependencies are not compatible with the operating system architecture of the local system on which you are running the endorctl scan. For example, projects with dependency on PyObjC can be run on Mac-based systems, but not Linux systems. A few Python libraries are incompatible with x32 architectures and can only be run on x64 architectures.
- Resolved dependency errors: A version of a dependency does not exist, or it cannot be found. It may have been removed from the repository.
- Call graph errors: These errors come if pip or Poetry are unable to build the project because a required dependency cannot be located.
5 - JavaScript/TypeScript
Learn how to implement Endor Labs in repositories with Javascript or Typescript packages.
JavaScript is a high-level, interpreted programming language primarily used for creating interactive and dynamic web content widely used by developers. Endor Labs supports the scanning and monitoring of JavaScript projects.
Using Endor Labs, developers can:
- Test their software for potential issues and violations of organizational policy
- Prioritize vulnerabilities in the context of their applications
- Understand the relationships between software components in their applications
Scan JavaScript projects
To successfully scan your JavaScript or TypScript applications:
Install software prerequisites
- Endor Labs requires the following pre-requisite software to be installed to successfully perform a scan:
- Yarn: Any version
- npm: 6.14.18 or higher versions
- pnpm: 3.0.0 or higher versions
- Make sure your repository includes one or more files with
.js
or .ts
extension.
- Make sure that you have the following minimum system specification requirements:
Processor |
Memory |
4-core |
16 GB |
Build JavaScript projects
You can choose to build your JavaScript projects before running a scan. This will ensure that either a package-lock.json, yarn.lock, or pnpm-lock.yaml file is created enhancing the scan speed.
Ensure your repository has package.json and run the following command making sure it builds the project successfully.
For npm:
For Yarn:
For pnpm:
If the project is not built, endorctl builds the project during the scan and generate either package-lock.json, yarn.lock, or pnpm-lock.yaml file. Make sure that either npm, Yarn, or pnpm is installed on your system. If your repository includes a lock file, endorctl uses the existing file for dependency resolution and does not create it again.
Run a scan
Perform a scan to get visibility into your software composition and resolve dependencies.
To detect dependencies when using pnpm:
If you are using pnpm, set the environment variable ENDOR_PNPM_ENABLED
to true
and then run the scan.
export ENDOR_PNPM_ENABLED=true
To enable dependency reachability:
To enable dependency reachability that detects dependencies used in source code but not declared in the package’s manifest files, set the flag --call-graph-languages
with javascript,typescript
.
endorctl scan --call-graph-languages=javascript,typescript
You can perform the scan from within the root directory of the Git project repository, and save the local results to a results.json file. The results and related analysis information are available on the Endor Labs user interface.
endorctl scan -o json | tee /path/to/results.json
You can sign into the Endor Labs user interface, click the Projects on the left sidebar, and find your project to review its results.
Understand the scan process
Dependency analysis tools analyze the lock file of an npm, yarn, or pnpm based package and attempt to resolve dependencies. To resolve dependencies from private repositories, the settings of the .npmrc file in the repository is considered.
Endor Labs surpasses mere manifest file analysis by expertly resolving JavaScript dependencies and identifies:
- Dependencies listed in the manifest file but not used by the application
- Dependencies used by the application but not listed in the manifest file
- Dependencies listed in the manifest as transitive but used directly by the application
- Dependencies categorized as test in the manifest, but used directly by the application
Developers can eliminate the false positives, false negatives, and easily identify test dependencies with this analysis. The dependencies used in source code but not declared in the package’s manifest files are tagged as Phantom.
Endor Labs also supports npm, Yarn, and pnpm workspaces out-of-the-box. If your JavaScript frameworks and packages use workspaces, Endor Labs will automatically take the dependencies from the workspace to ensure that the package successfully builds.
Scan speed is enhanced if the lock file exists in the repository. endorctl does not perform a build and uses the existing files in the repository for analysis.
Known Limitations
- Endor Labs doesn’t currently support local package references
- If a dependency can not be resolved in the lock file, building that specific package may be unsuccessful. This package may have been removed from npm or the .npmrc file is not properly configured. Other packages in the workspace are scanned as usual.
- Call graph generation is not supported for JavaScript
Troubleshoot errors
- Unresolved dependency errors:
The manifest file package.json is not buildable. Try running
npm install
, yarn install
, or pnpm install
in the root project to debug this error.
- Resolved dependency errors:
A version of a dependency does not exist or it cannot be found. It may have been removed from the repository.
6 - Ruby
Learn how to implement Endor Labs in repositories with Ruby packages.
Ruby is a widely used open-source programming language. Endor Labs supports scanning and monitoring of Ruby projects.
Using Endor Labs, developers can:
- Test their software for potential issues and violations of organizational policy
- Prioritize vulnerabilities in the context of their applications
- Understand the relationships between software components in their applications
Scan Ruby projects
To successfully scan your Ruby applications:
Install software prerequisites
The following prerequisites must be fulfilled:
- All applications monitored by Endor Labs must be on Ruby versions 2.6 or higher.
- A Gemfile or a
*.gemspec
file must be present in your Ruby project.
- Make sure your repository includes one or more files with
.rb
extension.
Build Ruby projects
You can choose to build your Ruby projects before running a scan. This will ensure thatgemfile.lock
is created.
Ensure your repository has Gemfile and run the following command making sure it builds the project successfully.
If the project is not built, endorctl will build the project during the scan and generate Gemfile.lock
. If the repository includes a Gemfile.lock
, endorctl uses this file for dependency resolution and does not create it again.
If you have a private registry and internal dependencies on other projects, you must configure private registries. Endor Labs can fetch the gems that are hosted in a private gem repository which are not available publicly after authenticating the endpoints.
- Sign in to Endor Labs and select Integrations under Manage from the left sidebar.
- From Package Managers, select Ruby Gems and click Manage.
- Click Add Package Manager.
- Enter a package manager URL.
- To enable Endor Labs to authenticate to your registry, select Authenticate to this registry and enter the username and password of your private package manager repository.
- Click Add Package Manager to save your configuration.
Run a scan
Perform a scan to get visibility into your software composition and resolve dependencies.
You can perform the scan from within the root directory of the Git project repository, and save the local results to a results.json file. The results and related analysis information are available on the Endor Labs user interface.
endorctl scan -o json | tee /path/to/results.json
You can sign into the Endor Labs user interface, click the Projects on the left sidebar, and find your project to review its results.
Understand the scan process
Endor Labs looks for Gemfile
, *.gemspec
, and Gemfile.lock
files to find and monitor the dependency activity.
- A Gemfile is a configuration file used in Ruby projects to specify the required RubyGems (libraries or packages) for the project’s dependencies.
- A
*.gemspec
file is a RubyGems specification file used to define the metadata and dependencies for a RubyGem.
- The
Gemfile.lock
file is automatically generated by Bundler and is used to lock down the specific versions of gems and their dependencies installed in your project’s environment.
If the Gemfile.lock
is not present in your project, Endor Labs generates this file and stores it in a temp directory. The file is deleted after extracting dependency information.
Endor Labs’ dependency resolution mechanism assesses multiple factors, including compatibility, stability, and availability, to determine the most suitable version for usage. The resolved dependency version is used during the build or execution of your Ruby project. By utilizing the dependency graph, you can access significant information regarding the dependencies. This includes determining whether a dependency is direct or transitive, checking its reachability, verifying source availability, and more. The dependency graph provides a visual representation that allows you to examine the graphical details of these dependencies.
Known limitations
- Call graphs are not supported for Ruby projects.
- If a dependency can not be resolved in the Gemfile, building that specific package may not be successful. This package may have been removed from the Gem package manager. Other packages in the workspace are scanned.
Troubleshoot errors
- Unresolved dependency errors:
The Gemfile is not buildable. Try running
bundler install
in the root project to debug this error.
- Resolved dependency errors:
A version of a dependency does not exist or it cannot be found. It may have been removed from the repository.
7 - .NET
Learn how to implement Endor Labs in repositories with .NET packages.
.NET is a free, cross-platform, open-source developer platform for building different types of applications. Endor Labs supports the scanning and monitoring of projects built on the .NET platform.
Using Endor Labs, developers can:
- Test their software for potential issues and violations of organizational policy
- Prioritize vulnerabilities in the context of their applications
- Understand the relationships between software components in their applications
Scan .NET projects
To successfully scan your .NET projects
- Install software prerequisites
- Run a scan
- Understand the scan process
- Troubleshoot errors
Install software prerequisites
The following prerequisite must be fulfilled:
- Make sure your repository includes one or more files with
.cs
extension.
- One or more *.csproj files must be present in your repository.
- The .NET command or Nuget command must be installed and available on the host system.
- At least one .NET SDK installed on the system must be compatible with the project’s global.json file settings.
Note
To check your available SDK versions you can run the command dotnet --info
or dotnet --list-sdks
.
Call graph requirements
- You must install .NET 7.0.1 (SDK 7.0.101) or later on the host system.
- Endor Labs’ call graph support for .NET is based on Microsoft’s Common Intermediate Language (CIL). Artifacts such as .exe or .dll files must be available in the project’s standard workspace through a build and restore or a restored cache.
- When performing deep scans make sure that you have the following minimum system specification requirements:
- 4-core processor with 16 GB RAM for small projects
- 8-core processor with 32 GB RAM for mid-size projects
- 16-core processor with 64 GB RAM for large projects
Run a scan
Use the following options to scan your repositories. Perform a scan after building the projects.
Option 1 - Quick scan
Perform a quick scan to get quick visibility into your software composition. This scan won’t perform reachability analysis to help you prioritize vulnerabilities.
You must restore your .NET projects before running a quick scan. Additionally, ensure that the packages are downloaded into the local package caches and that the build artifacts are present in the standard locations.
- Run the following commands to resolve dependencies and create the necessary files to scan your .NET project.
To ensure that the build artifacts project.assets.json
file is generated and dependencies are resolved run:
If you use Nuget instead run:
To create a packages.lock.json
file if your project uses a lock file run:
dotnet restore --use-lock-file
If project.assets.json
or packages.lock.json
are not present and if the project is buildable, endorctl will restore the project and create a project.assets.json
or a packages.lock.json
file to resolve dependencies.
2. You can run a quick scan with the following commands:
endorctl scan --quick-scan
You can perform the scan from within the root directory of the Git project repository, and save the local results to a results.json file. The results and related analysis information are available on the Endor Labs user interface.
endorctl scan --quick-scan -o json | tee /path/to/results.json
You can sign into the Endor Labs user interface, click the Projects on the left sidebar, and find your project to review its results.
Option 2 - Deep scan
Use the deep scan to perform dependency resolution, reachability analysis, and generate call graphs. You can do this after you complete the quick scan successfully.
You must restore and build your .NET projects before running a deep scan. Additionally, ensure that the packages are downloaded into the local package caches and that the build artifacts are present in the standard locations.
- Run the following commands to restore and build your project. This may vary depending on your project’s configuration.
dotnet restore
dotnet build
- You can run a deep scan with the following commands:
Use the following flags to save the local results to a results.json file. The results and related analysis information are available on the Endor Labs user interface.
endorctl scan -o json | tee /path/to/results.json
When a deep scan is performed all private software dependencies are completely analyzed by default if they have not been previously scanned. This is a one-time operation and will slow down initial scans, but won’t impact subsequent scans.
Organizations might not own some parts of the software internally and findings are actionable by another team. These organizations can choose to disable this analysis using the flag disable-private-package-analysis
. By disabling private package analysis, teams can enhance scan performance but may lose insights into how applications interact with first-party libraries.
Use the following command flag to disable private package analysis:
endorctl scan --disable-private-package-analysis
You can sign into the Endor Labs user interface, click the Projects on the left sidebar, and find your project to review its results.
You can configure Endor Labs to fetch dependencies from private NuGet feeds after authenticating the endpoints.
- Sign in to Endor Labs and select Integrations under Manage from the left sidebar.
- From Package Managers, select Nuget and click Manage.
- Click Add Package Manager.
- Enter a package manager URL.
- To enable Endor Labs to authenticate to your registry, select Authenticate to this registry and enter the username and password of your private package manager repository.
- Click Add Package Manager to save your configuration.
Understand the scan process
A *.csproj file is an XML-based C# project file that contains information about the project, such as its source code files, references, build settings, and other configuration details. The dependencies and findings are listed individually for every csproj file. The scan discovers all *.csproj**
files and uses these files to resolve the appropriate dependency graph of your project.
(Beta) Endor Labs scans the .NET projects that are using the Central Package Management feature of Nuget for the packages declared as:
- Package references in
Directory.Build.props
or Directory.Packages.props
files.
- Package references in any *.props file and the prop file is imported in the csproj file.
- Package references in
*.Targets
file.
Note
You may not be able to view the Requested version of the packages on the Endor Labs user interface
- For the packages declared as package version in *.Targets file.
- If you are importing the packages into the *.csproj file using MSbuild keywords in the path variables.
Endor Labs enriches your dependency graph to help you understand if your dependencies are secure, sustainable, and trustworthy. This includes Endor Labs risk analysis and scores, if a dependency is direct or transitive, and if the source code of the dependency is publicly auditable.
Software composition analysis for .NET is performed in the following ways:
How does dependency resolution happen using Project.assets.json
The Project.assets.json file is used in .NET projects to store metadata and information about the project’s dependencies and assets.
Endor Labs fetches resolved package versions, paths to the dependencies’ assets, such as assemblies and resources, and other related information from this file. If a project does not include a project.assets.json file, it is generated through the dotnet restore
or the nuget restore
command. This command uses all the configured sources to restore dependencies as well as project-specific tools that are specified in the project file.
Note
If the host machine has .NET Core or .NET 5+ installed, the dotnet restore command is used to generate the project.assets.json file. The nuget restore command is used to generate the project.asssets.json file for earlier versions of the .NET frameworks.
How does dependency resolution happen using package.lock.json
The package.lock.json file is used in .NET projects to lock dependencies and their specific versions. It is a snapshot of the exact versions of packages installed in a project, including their dependencies and sub-dependencies, requested versions, resolved versions, and contenthash. The lock file provides a more dependable, uniform, and accurate representation of the dependency graph.
In Endor Labs’ dependency management, the resolution of dependencies is primarily based on package.lock.json, which takes precedence over projects.assets.json to resolve dependencies.
Endor Labs fetches the dependency information from package.lock.json and creates a comprehensive dependency graph. The vulnerabilities associated with the dependencies are listed on the Endor Labs’ user interface.
If the package.lock.json file is not present in the repository, Endor Labs triggers the restore process to generate the package.lock.json file and uses it to perform the dependency scans.
Endor Labs performs static analysis on the C# code based on the following factors:
- Call graphs are created for your package. These are then combined with the call graphs of the dependencies in your dependency tree to form a comprehensive call graph for the entire project.
- Endor Labs looks for the project’s .dll files typically located within the bin directory.
- Endor Labs performs an inside-out analysis of the software to determine the reachability of dependencies in your project.
- The static analysis time may vary depending on the number of dependencies in the package and the number of packages in the project.
Note
.NET’s call graph support and reachability analysis are in Beta.
Known Limitations
- The following .NET programming languages are not currently supported for dependency resolution or call graph generation.
- Projects written in F#
- Projects written in Visual Basic
- When using the GitHub app, either resolve all the private and internal dependencies, or Configure Nuget private repositories before running a scan.
- Call graph binary discovery may fail if you use environment variables to define the name of the package in your *.csproj file.
Troubleshoot errors
Here are a few error scenarios that you can check for and attempt to resolve them.
- Host system check failure errors:
.NET or Nuget is not installed or not present in the PATH environment variable. Install Nuget and try again.
- Unresolved dependency errors:
This error occurs when the .csproj file can not be parsed or if it has syntax errors.
8 - Bazel
Learn how to implement Endor Labs in monorepos using Bazel
Bazel is an open-source build and test tool, which is commonly used in monorepos. Bazel is used to quickly build software across multiple languages.
Using Endor Labs, organizations relying on Bazel can:
- Test their software for potential issues and violations of organizational policy
- Prioritize vulnerabilities in the context of their applications
- Understand the relationships between software components in their applications
Scan your Bazel projects
To successfully scan using Bazel:
Install software prerequisites
The following prerequisite must be fulfilled:
- One or more WORKSPACE files must be present in your repository.
- The
bazel
command must be installed and available on the host system. To install Bazel, see the Bazel documentation.
- When performing deep scans make sure that you have the following minimum system specification requirements:
- 4-core processor with 16 GB RAM for small projects
- 8-core processor with 32 GB RAM for mid-size projects
- 16-core processor with 64 GB RAM for large projects
- Bazel versions 5.x.x and 6.x.x are supported.
Select and build your Bazel targets
Endor Labs supports scanning targets using the following language-specific Bazel rules:
-
Bazel Rules for Java support included for 4.1 or higher versions.
-
Bazel Rules for Python support included for 0.9.0 or higher versions.
-
Bazel Rules for Golang support included for 0.40.1 or higher versions with Bazel versions 5.x.x, 6.x.x. 0.42.0 or higher versions with Bazel versions 7.x.x.
-
Bazel Rules for Scala support is available for versions 5.0.0 to 6.6.0, including 5.0.0 and 6.6.0.
-
To scan with Endor Labs you’ll need to specify a list of targets to scan or a Bazel query for which all targets matching your query criteria are scanned.
-
To select your Bazel targets you can search using the Bazel query language for specific targets to scan, or scan all targets that match a given query.
Here are some examples.
- To get all targets created with a
java_binary
build rule you can use the query:
bazel query 'kind(java_binary, //...)'
- To get all targets created with a
py_binary
build rule you can use the query:
bazel query 'kind(py_binary, //...)'
- To get all targets created with a
go_binary
build rule under the golang
directory you can use the query:
bazel query 'kind(go_binary, //...)'
- To get all targets created with a
scala_binary
build rule under the scala
directory you can use the query:
bazel query 'kind(scala_binary, //...)'
In general, refine your query to select the most important targets in your monorepo and align with your existing build workflows.
You can choose to build the targets before running the scan. Use the bazel build
commands to do this by passing a comma-separated list of targets. For example, //:test
and //:test2
run bazel build //:test,//:test2
. endorctl will attempt a scan if the targets are not built. endorctl uses bazel build //:test
and bazel query 'deps( //:test)' --output graph
to build your targets.
Run a scan
Use the following options to scan your repositories. Perform a scan after building the projects. See
Once you’ve selected your targets you can define the targets for scanning using one of three command line arguments:
To include or exclude specific targets, you can pass a comma-separated list of targets to --bazel-exclude-targets
or --bazel-include-targets
.
To scan a specific list of targets, use the command:
endorctl scan --use-bazel --bazel-include-targets=//your-target-name
To scan a list of targets using the Bazel query language, use the following command and replace the query below with your own:
endorctl scan --use-bazel --bazel-targets-query='kind(java_binary, //...)
Finally, if your workspace file is not located at the root of the repository you must define the WORKSPACE file location for the targets you would like to scan. For example:
endorctl scan --use-bazel --bazel-targets-query='kind(java_binary, //...) --bazel-workspace-path=./src/java
Option 1 - Quick scan
Perform a quick scan to get quick visibility into your software composition. This scan won’t perform reachability analysis to help you prioritize vulnerabilities.
endorctl scan --use-bazel --bazel-include-targets=//your-target-name --quick-scan
You can perform the scan from within the root directory of the Git project repository, and save the local results to a results.json file. The results and related analysis information are available on the Endor Labs user interface.
endorctl scan --use-bazel --bazel-include-targets=//your-target-name --quick-scan -o json | tee /path/to/results.json
You can sign into the Endor Labs user interface, click the Projects on the left sidebar, and find your project to review its results.
Option 2 - Deep scan
Use the deep scan to perform dependency resolution, reachability analysis, and generate call graphs. You can do this after you complete the quick scan successfully.
You can run a deep scan with the following commands:
endorctl scan --use-bazel --bazel-include-targets-query=//your-target-name
Use the following flags to save the local results to a results.json file. The results and related analysis information are available on the Endor Labs user interface.
endorctl scan --use-bazel --bazel-include-targets-query=//your-target-name -o json | tee /path/to/results.json
When a deep scan is performed all private software dependencies are completely analyzed by default if they have not been previously scanned. This is a one-time operation and will slow down initial scans, but won’t impact subsequent scans.
Organizations might not own some parts of the software internally and findings are actionable by another team. These organizations can choose to disable this analysis using the flag disable-private-package-analysis
. By disabling private package analysis, teams can enhance scan performance but may lose insights into how applications interact with first-party libraries.
Use the following command flag to disable private package analysis:
endorctl scan --use-bazel --bazel-include-targets=//your-target-name --disable-private-package-analysis
You can sign into the Endor Labs user interface, click the Projects on the left sidebar, and find your project to review its results.
Understand the scan process
To understand the scan process for Java projects, see Endor Labs for Java.
To understand the scan process for Python projects, see Endor Labs for Python.
To understand the scan process for Go projects, see Endor Labs for GO.
Known limitations
- Scanning Java binaries using Bazel is not supported.
9 - Swift/Objective-C (Beta)
Learn how to implement Endor Labs in repositories with CocoaPods packages.
CocoaPods is a popular package manager for Swift and Objective-C. It simplifies the integration of Swift and Objective-C dependencies through Podfile declaration and automated installation.
Using Endor Labs, developers can:
- Test their software for potential issues and violations of organizational policy
- Prioritize vulnerabilities in the context of their applications
- Understand the relationships between software components in their applications
Scan CocoaPods projects
To successfully scan your CocoaPods projects:
Install software prerequisites
The following prerequisites must be fulfilled:
- All applications monitored by Endor Labs must be on CocoaPods versions 0.9.0 or higher.
- A
Podfile
and a Podfile.lock
must be present in your CocoaPods project.
- Make sure your repository includes one or more files with
.swift
, .h
or .m
extension.
Build CocoaPods projects
If the Podfile.lock
is not present in your repository, run the following command to create the Podfile.lock
for your Podfile.
Run a scan
Perform a scan to get visibility into your software composition and resolve dependencies. Use the flag --languages=swift
along with the endorctl scan to discover Swift and Objective-C dependencies.
You can perform the scan from within the root directory of the Git project repository, and save the local results to a results.json file. The results and related analysis information are available on the Endor Labs user interface.
endorctl scan -o json | tee /path/to/results.json
You can sign into the Endor Labs user interface, click the Projects on the left sidebar, and find your project to review its results.
Understand the scan process
Endor Labs looks for the Podfile and Podfile.lock files to discover the dependencies used by an application.
- A
Podfile
is a configuration file used in CocoaPods projects to specify the required libraries or packages for the project’s dependencies.
- A
Podfile.lock
file is a CocoaPods specification file used to define the metadata and dependencies.
To successfully discover Swift and Objective-C dependencies, both Podfile and Podfile.lock files must be present in your project for each Podfile.
Known limitations
- Call graphs are not supported for the CocoaPods projects.
- If a
Podfile.lock
file is not present, Endor Labs will skip analyzing the project and present a warning that the package was skipped.
10 - Scala
Learn how to implement Endor Labs in repositories with Scala packages.
Scala is a general-purpose and scalable programming language widely used by developers. Endor Labs supports the scanning and monitoring of Scala projects managed by the interactive build tool sbt.
Using Endor Labs, developers can:
- Test their software for potential issues and violations of organizational policy
- Prioritize vulnerabilities in the context of their applications
- Understand the relationships between software components in their applications
Scan Scala projects
To successfully scan your Scala applications:
Install software prerequisites
The following prerequisites must be fulfilled:
- A manifest file for the Scala build tool, build.sbt must be present in your repository.
- Make sure your repository includes one or more files with
.sc
or .scala
extension.
- If your sbt version is lower than 1.4, you must install the sbt-dependency-graph plugin. The sbt-dependency-graph plug-in is by default integrated into the sbt versions 1.4 and higher.
- Make sure that the project/build.properties file has the required sbt version.
- Make sure that your system has a minimum 8-core processor with 32 GB RAM to successfully scan Scala projects.
Option 1 - Quick scan
You must be able to build your Scala projects before running a scan. The standard .sbt
cache must exist and contain successfully downloaded dependencies.
-
Ensure your repository has a build.sbt
file and run the following commands making sure it builds the project successfully.
-
Make sure sbt dependencyTree
runs successfully inside the project directory.
Run a scan
Perform a scan to get visibility into your software composition and resolve dependencies.
You can perform the scan from within the root directory of the Git project repository, and save the local results to a results.json file. The results and related analysis information are available on the Endor Labs user interface.
endorctl scan -o json | tee /path/to/results.json
You can sign into the Endor Labs user interface, click the Projects on the left sidebar, and find your project to review its results.
Option 2 - Deep scan
You must be able to build your Scala projects before running a scan. The build artifact as well as the standard .sbt cache must exist and contain successfully downloaded dependencies.
-
Ensure your repository has a build.sbt
file and run the following commands making sure it builds the project successfully.
-
Make sure sbt dependencyTree
runs successfully inside the project directory.
Run a scan
Perform a scan to get visibility into your software composition and resolve dependencies.
You can perform the scan from within the root directory of the Git project repository, and save the local results to a results.json file. The results and related analysis information are available on the Endor Labs user interface.
endorctl scan -o json | tee /path/to/results.json
You can sign into the Endor Labs user interface, click the Projects on the left sidebar, and find your project to review its results.
Understand the scan process
Endor Labs scans Scala projects by executing sbt plugins and inspecting the build.sbt file to retrieve information about direct and transitive dependencies.
-
The build.sbt file is a configuration file used in Scala projects with sbt to define project settings, dependencies, and build tasks. This file provides the necessary configuration and instructions to sbt on resolving and managing project dependencies.
-
The sbt dependency graph plugin visualizes the dependencies between modules in a Scala project.
Endor Labs analyzes information from both these methods to determine different components, binary files, manifest files, images, and more in the Scala codebase and presents finding policy violations, identifying, and resolving dependencies.
Using Endor Labs users can gain significant insights into the structure and relationships of their Scala project’s dependencies, aiding in managing dependencies effectively, identifying potential issues, and ensuring a well-organized and maintainable codebase.
Endor Labs performs static analysis based on the following factors:
- Call graphs are created for your package. These are then combined with the call graphs of the dependencies in your dependency tree to form a comprehensive call graph for the entire project.
- Endor Labs performs an inside-out analysis of the software to determine the reachability of dependencies in your project.
- The static analysis time may vary depending on the number of dependencies in the package and the number of packages in the project.
Known Limitations
- Software composition analysis for Scala on Microsoft Windows operating systems is currently unsupported.
- Scala packages built with Gradle are not currently supported.
Troubleshoot errors
Here are a few error scenarios that you can check for and attempt to resolve them.
- Host system check failure errors: These errors occur if:
- If sbt is not installed or present in the path variable. Install sbt 1.4 or higher versions and try again.
- If the sbt version mentioned in the project or the
build.properties
file is lower than 1.4 and the sbt-dependency-graph
plug-in is not installed. Install the sbt-dependency-graph
plug-in and try again.
- Dependency graph errors - Scala by default imports
MiniDependencyTreePlugin
which is a mini version of the sbt-dependency-graph
plugin and it supports only dependencyTree
command. To get complete features of the sbt-dependency-graph
plugin, add DependencyTreePlugin
to your project/plugins.sbt
file and run the scan again. See Scala documentation for details.
11 - PHP
Learn how to implement Endor Labs in repositories with PHP packages using composer.
PHP is a popular server-side scripting language primarily used for web development. Endor Labs supports the scanning and monitoring of PHP projects.
Using Endor Labs, developers can:
- Test their software for potential issues and violations of organizational policy
- Prioritize vulnerabilities in the context of their applications
- Understand the relationships between software components in their applications
Scan PHP projects
To successfully scan your PHP applications:
Install software prerequisites
- One of the following prerequisites must be fulfilled:
- The PHP project must contain a
composer.json
file. If the project includes the composer.lock
file it is beneficial, but this is not a mandatory requirement.
- If the composer.lock file is not present in the repository, it is necessary to have PHP and Composer installed before running a scan on your local system.
- Make sure your repository includes one or more files with
.php
extension.
- The following versions are supported for PHP and Composer:
- PHP 5.3.2 and higher versions
- Composer 2.2.0 and higher versions
Build PHP projects
You can choose to build your PHP projects before running a scan. This will ensure that composer.lock is created.
Ensure your repository has composer.json
and run the following command making sure it builds the project successfully.
If the project is not built, endorctl will build the project during the scan and generate composer.lock
. If the repository includes a composer.lock
, endorctl uses this file for dependency resolution and does not create it again.
If you have a private registry and internal dependencies on other projects, you must configure private registries.
To configure private Composer package repositories:
- Sign in to Endor Labs and select Integrations under Manage from the left sidebar.
- From Package Managers, select Packagist and click Manage.
- Click Add Package Manager.
- In PACKAGE MANAGER HOST, enter the host domain of the package manager.
- From the available options, choose the authentication method for private repositories.
- To enable Endor Labs to authenticate to your registry, select Authenticate to this registry and enter the required details of your private package manager repository.
- Click Add Package Manager to save your configuration.
Run a scan
Perform a scan to get visibility into your software composition and resolve dependencies.
You can perform the scan from within the root directory of the Git project repository, and save the local results to a results.json file. The results and related analysis information are available on the Endor Labs user interface.
endorctl scan -o json | tee /path/to/results.json
You can sign into the Endor Labs user interface, click the Projects on the left sidebar, and find your project to review its results.
Understand the scan process
Endor Labs discovers all composer.json files in your PHP project and uses these files to resolve the dependencies of your packages. Composer is a PHP dependency management tool that enables you to specify the libraries your project relies on and manages the process of installing or updating them. The dependencies and findings are listed in the Endor Labs application individually for every composer.json file.
In Endor Labs’ dependency management, the resolution of dependencies is based on both composer.json and composer.lock files. The composer.lock file is generated by Composer and includes information such as resolved versions, package information, transitive dependencies, and other details. Using the composer.lock file ensures deterministic dependency installation by recording the exact versions of installed dependencies and their transitive dependencies. If the composer.lock file is not present in the repository, Endor Labs generates the composer.lock file, and uses it to analyze the operational and security risks associated with your package’s dependencies. Endor Labs fetches the dependency information and creates a comprehensive dependency graph.
Known Limitations
Call graphs are not supported for PHP projects.
Troubleshoot errors
- Unresolved dependency errors:
The composer.json is not buildable. Try running
composer install
in the root project to debug this error.
- Resolved dependency errors:
A version of a dependency does not exist or it cannot be found. It may have been removed from the repository.
12 - Rust
Learn how to implement Endor Labs in repositories with Rust packages.
Rust is a software programming language widely used by developers. Endor Labs supports scanning and monitoring of Rust projects.
Using Endor Labs, developers can:
- Test their software for potential issues and violations of organizational policy
- Prioritize vulnerabilities in the context of their applications
- Understand the relationships between software components in their applications
Scan Rust projects
To successfully scan your Rust applications:
- Install software prerequisites
- Build Rust projects
- Run a scan
- Understand the scan process
- Troubleshoot errors
Install software prerequisites
- Make sure the following pre-requisites are installed:
- Package Manager Cargo - Any version
- Rust - Any version,
- Make sure your repository includes one or more files with
.rs
extension.
- Install Rust using the latest rustup tool.
- Make sure that you have a minimum system requirement specification of an 8-core processor with 32 GB RAM. s
- Use a system equipped with either Mac OS X or Linux operating systems to perform the scans.
Build Rust projects
Ensure your repository has Cargo.toml
file and run the following command making sure it builds the project successfully.
If the project is not built, endorctl will build the project during the scan and generate the Cargo.lock
file. If the repository includes a Cargo.lock
file, endorctl uses this file for dependency resolution and does not create it again.
Run a scan
Use the following options to scan your repositories. Perform the endorctl scan after building the projects.
Option 1 - Quick scan
Perform a quick scan to get quick visibility into your software composition and perform dependency resolution. It discovers dependencies that the package has explicitly declared. If the package’s build file is incomplete then the dependency list will also be incomplete. This scan won’t perform the reachability analysis to help you prioritize vulnerabilities.
endorctl scan --quick-scan
You can perform the scan from within the root directory of the Git project repository, and save the local results to a results.json file. The results and related analysis information are available on the Endor Labs user interface.
endorctl scan --quick-scan -o json | tee /path/to/results.json
You can sign into the Endor Labs user interface, click the Projects on the left sidebar, and find your project to review its results.
Option 2 - Deep scan
Use the deep scan to perform dependency resolution, reachability analysis, and generate call graphs. You can do this after you complete the quick scan successfully.
Important
Rust call graphs are built based on the
MIRAI intermediate representation tool. The tool relies on the nightly Rust builds. The Endor Labs Docker container includes the necessary tool chains required to scan Rust projects. Hence, the scan can be performed only using the Endor Lab’s Docker container.
endorctl comes bundled as a Docker image for portable usage and integration into continuous integration (CI) pipelines. To configure the endorctl Docker image, you must perform the following steps:
- Install Docker
- Get Endor Labs API credentials
- Export your environment variables
- Scan Rust projects
Export your environment variables
endorctl requires four environment variables for your source control system and your Endor Labs tenant.
These environment variables are:
- ENDOR_API_CREDENTIALS_KEY - The API key used to authenticate against the Endor Labs API.
- ENDOR_API_CREDENTIALS_SECRET - The API key secret used to authenticate against the Endor Labs API.
- ENDOR_NAMESPACE - The Endor Labs namespace you want to scan against. Locate the namespace from the top left-hand corner, under the Endor Labs logo on the Endor Labs application,.
- SOURCE_PATH - The path to your source code that may be mounted to the Docker container.
To export your environment variables run the following commands and insert the environment variable values in each command.
export ENDOR_NAMESPACE=name-of-your-namespace
export ENDOR_API_CREDENTIALS_KEY=endorlabs-api-key
export ENDOR_API_CREDENTIALS_SECRET=endorlabs-api-secret
export SOURCE_PATH=/path/to/your/source/code
Scan Rust projects
To scan your rust project run the following command:
docker run -it --rm \
-e ENDOR_NAMESPACE=$ENDOR_NAMESPACE \
-e ENDOR_API_CREDENTIALS_KEY=$ENDOR_API_CREDENTIALS_KEY \
-e ENDOR_API_CREDENTIALS_SECRET=$ENDOR_API_CREDENTIALS_SECRET \
-v $SOURCE_PATH:/root/endorlabs \
us-central1-docker.pkg.dev/endor-ci/public/endorctl:latest \
scan --path=/root/endorlabs
Use the following command to save the local results to a results.json file. The results and related analysis information are available on the Endor Labs user interface.
docker run -it --rm \
-e ENDOR_NAMESPACE=$ENDOR_NAMESPACE \
-e ENDOR_API_CREDENTIALS_KEY=$ENDOR_API_CREDENTIALS_KEY \
-e ENDOR_API_CREDENTIALS_SECRET=$ENDOR_API_CREDENTIALS_SECRET \
-v $SOURCE_PATH:/root/endorlabs \
us-central1-docker.pkg.dev/endor-ci/public/endorctl:latest \
scan --path=/root/endorlabs -o json | tee /path/to/results.json
You can sign into the Endor Labs user interface, click the Projects on the left sidebar, and find your project to review its results.
Understand the scan process
Endor Labs performs the following steps when it scans Rust projects:
- Resolves dependencies for the package version
- Performs static analysis on your Rust code
Resolving Dependencies & Static Analysis for Rust
Endor Labs leverages the Cargo.toml file in Rust and uses this file to build the package version using cargo. Endor Labs uses the output from cargo metadata
to resolve dependencies specified in Cargo.toml files and construct the dependency graph.
- After building the package, call graphs are created for your package. These are then combined with the call graphs of the dependencies in your dependency tree to form a comprehensive call graph for the entire project. Use the call graphs to understand if vulnerabilities in your Rust code are reachable through a function associated with the known vulnerability.
- Endor Labs performs an inside-out analysis of the software to determine the reachability of dependencies in your project.
- The static analysis time may vary depending on the number of dependencies in the package and the number of packages in the project.
Known Limitations
- To perform static analysis on Rust packages, the package version must be able to be successfully built.
- Performing Endor Labs scans on the Microsoft Windows operating system is currently unsupported.
Troubleshoot errors
- Host system check failure errors:
These errors occur when Rust is not installed or not present in the path variable. Install Rust and try again.
- Call graph errors:
These errors occur when the project is not buildable and the required dependencies cannot be located.