Private package manager integration for Conan

• JFrog Artifactory
• AWS CodeArtifact
• Self-hosted Conan servers

• Access private Conan packages during dependency resolution
• Generate comprehensive security analysis including private dependencies
• Maintain complete visibility into your software supply chain

• Use package manager integrations to simplify scanning when authentication to private repositories is not part of standard manifest or settings files.
• Package manager integrations allow you to set custom repositories for each package ecosystem and the priority of each repository for scanning.

1. Select User menu > Integrations from the left sidebar.
2. Select Add next to the package manager configuration you want to add.
3. Select Add Package Manager.
4. Enter a Name for the integration.
5. Choose an authentication type and complete the required fields.

6. Optionally, under Advanced, select Propagate this package manager to all child namespaces to share this integration with child namespaces.
7. Click Add Package Manager.

​

Test package manager integration

1. Select User menu > Integrations from the left sidebar.
2. Click Manage in the package manager configuration you want to customize.
3. Click the vertical three dots of the package manager configured and select Test Connection.

​

Edit package manager integration

1. Select User menu > Integrations from the left sidebar.
2. Click Manage next to the package manager you want to edit.
3. Click the vertical three dots on the configured integration you want to edit and select Edit.
4. You can modify the name, package manager URL, and credentials.
5. Click Save Changes.

​

Configure a private Conan registry using API

​

Basic authentication

• <namespace> with your Endor Labs namespace
• <registry-url> with the URL of your Conan registry (for example, https://your-artifactory.example.com/artifactory/api/conan/conan-local)
• <remote-name> with a logical name for this registry (for example, artifactory)
• <username> with your registry username
• <password-or-token> with your registry password or API token

endorctl api create -r PackageManager -n <namespace> -d '
{
    "meta": {
        "name": "conan-private-registry",
        "description": "Private Conan registry with basic authentication"
    },
    "spec": {
        "conan": {
            "priority": 1,
            "url": "<registry-url>",
            "remote_name": "<remote-name>",
            "basic_auth": {
                "username": "<username>",
                "password": "<password-or-token>"
            }
        }
    },
    "propagate": false
}'

​

AWS CodeArtifact authentication

• <namespace> with your Endor Labs namespace
• <registry-url> with your AWS CodeArtifact endpoint URL (for example, https://<domain>-<account-id>.d.codeartifact.<region>.amazonaws.com/conan/<repository>/)
• <remote-name> with a logical name for this registry
• <domain> with your AWS CodeArtifact domain name
• <account-id> with your AWS account ID
• <repository> with your AWS CodeArtifact repository name
• <region> with the AWS region hosting your CodeArtifact repository
• <role-arn> with the ARN of the IAM role Endor Labs should assume
• <audience> with the allowed audience value configured in your trust policy

endorctl api create -r PackageManager -n <namespace> -d '
{
    "meta": {
        "name": "conan-codeartifact-registry",
        "description": "Private Conan registry with AWS CodeArtifact authentication"
    },
    "spec": {
        "conan": {
            "priority": 1,
            "url": "<registry-url>",
            "remote_name": "<remote-name>",
            "aws": {
                "domain": "<domain>",
                "domain_owner": "<account-id>",
                "repository": "<repository>",
                "region": "<region>",
                "target_role_arn": "<role-arn>",
                "allowed_audience": "<audience>"
            }
        }
    },
    "propagate": false
}'

​

Fetch package manager using API

endorctl api get -r packageManager -n <your namespace>  --uuid <package-manager-uuid>

​

Delete package manager using API

endorctl api delete -r packageManager -n <your namespace>  --uuid <package-manager-uuid>