Private package manager integration for Gradle

Configure Endor Labs to integrate with private Gradle repositories to access proprietary dependencies during security scanning and analysis. When your Gradle projects depend on artifacts hosted in private or corporate repositories, Endor Labs requires authentication credentials to resolve these dependencies and generate a complete bill of materials. This integration enables Endor Labs to:

Access private Gradle artifacts during dependency resolution
Generate comprehensive security analysis including private dependencies
Maintain complete visibility into your software supply chain

Endor Labs generally respects package authentication and configuration settings and a package manager integration is usually not required to scan private packages successfully.

Use package manager integrations to simplify scanning when authentication to private repositories is not part of standard manifest or settings files.
Package manager integrations allow you to set custom repositories for each package ecosystem and the priority of each repository for scanning.

To set up a package manager integration:

Select User menu > Integrations from the left sidebar.
Select Add next to the package manager configuration you want to add.
Select Add Package Manager.
Enter a Name for the integration.
Choose an authentication type and complete the required fields.

Optionally, under Advanced, select Propagate this package manager to all child namespaces to share this integration with child namespaces.
Click Add Package Manager.

Test package manager integration

For Gradle, connection testing applies only to AWS CodeArtifact and Google Artifact Registry integrations. A Basic integration has no endpoint to test. It shows Last Tested: N/A and you can validate it by running a scan or a manual curl against your private registry.

You can test the connection to a configured package manager to verify that Endor Labs can reach the repository. To test the connection:

Select User menu > Integrations from the left sidebar.
Click Manage in the package manager configuration you want to customize.
Click the vertical three dots of the package manager configured and select Test Connection.

The integration does not perform authentication or authorization checks on the package manager repository.

Edit package manager integration

You can edit an existing package manager integration to update the name, repository URL, or authentication credentials. To edit a package manager integration:

Select User menu > Integrations from the left sidebar.
Click Manage next to the package manager you want to edit.
Click the vertical three dots on the configured integration you want to edit and select Edit.
You can modify the name, package manager URL, and credentials.
Click Save Changes.

Private package manager integration for Gradle using API

Configure private package manager integration with Gradle to authenticate and fetch dependencies from private repositories during scans. Gradle requires valid credentials, such as AWS access keys and GitHub or GitLab tokens, to access private repositories and fetch dependencies. Provide these credentials through the endorctl API call for GitHub App scans to run successfully. The variable names you define (like mavenAccessKey, mavenSecretKey) must exactly match the property names referenced in settings.gradle, build.gradle, or gradle.properties files when configuring credentials. For more information on how to align variable names with your build configuration, refer to Declaring private repositories.

You can configure these credentials for the scans performed through the GitHub App.

Set Gradle credentials

Use endorctl to configure your repository credentials. You can set the necessary Gradle properties, allowing access to private repositories during the Gradle build process. For example, to authenticate with an AWS S3-backed Maven repository, run the following commands to set the mavenAccessKey and mavenSecretKey properties. Replace namespace with your namespace.

endorctl api create -n <namespace> -r PackageManager -d '{
    "meta": {
        "name": "gradle properties"
    },
    "spec": {
        "gradle": {
            "property_key_name": "mavenAccessKey",
            "property_key_value": "your-access-key"
        }
    }
}'

endorctl api create -n <namespace> -r PackageManager -d '{
    "meta": {
        "name": "gradle properties"
    },
    "spec": {
        "gradle": {
            "property_key_name": "mavenSecretKey",
            "property_key_value": "your-secret-key"
        }
    }
}'

These credentials will then be available to your Gradle build at scan time. All values configured through the API are automatically exported as environment variables.

Considerations

When configuring Gradle credentials, consider the following scenarios:

AWS credentials with scan profile

If you link a scan profile to your project, AWS credentials are directly written into ~/.gradle/gradle.properties and require exact key matches. You can use one of the following combinations:

AWS_ACCESS_KEY and AWS_SECRET_KEY
AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY

Resolve Gradle plugins from a private Maven registry

If your Gradle build fails to resolve plugins hosted in a private Maven-format registry, configure a Gradle package manager integration. Use the same Gradle integration you already use for private library dependency resolution.

A Gradle package manager integration always applies to plugin resolution as well as library dependency resolution.

Set the Property Key and Property Value fields to match your settings.gradle pluginManagement block declares for authentication. Gradle supports two credential types:

PasswordCredentials: A username property and a password property.
HttpHeaderCredentials: A header-based credential, commonly a bearer token sent in the Authorization header.

endorctl exports each configured property as an ORG_GRADLE_PROJECT_<property_key_name> environment variable.

The <property_key_name> value is case sensitive. It must match the property name your pluginManagement block’s credentials or url declarations reference, such as artifactory_contextUrl or artifactory_password.

For more information, refer to Declaring private repositories.

Authenticate using mutual TLS

Use mutual TLS to securely authenticate to artifact repositories. Currently, you can configure mutual TLS only through the API. See mTLS authentication for more information.

Fetch package manager using API

Run the following command to fetch the package manager using the UUID.

endorctl api get -r packageManager -n <your namespace>  --uuid <package-manager-uuid>

Delete package manager using API

Run the following command to delete the package manager using the UUID.

endorctl api delete -r packageManager -n <your namespace>  --uuid <package-manager-uuid>

Introduction

Setup & Deployment

Inventory & Insights

Scan with Endor Labs

Risk Remediation

Integrations

Secure AI Coding

Platform Administration

Best Practices

Research Open Source Risks

Trust & Compliance

Private package manager integration for Gradle

Test package manager integration

Edit package manager integration

Private package manager integration for Gradle using API

Set Gradle credentials

Considerations

AWS credentials with scan profile

Resolve Gradle plugins from a private Maven registry

Authenticate using mutual TLS

Fetch package manager using API

Delete package manager using API

​Test package manager integration

​Edit package manager integration

​Private package manager integration for Gradle using API

​Set Gradle credentials

​Considerations

​AWS credentials with scan profile

​Resolve Gradle plugins from a private Maven registry

​Authenticate using mutual TLS

​Fetch package manager using API

​Delete package manager using API

Test package manager integration

Edit package manager integration

Private package manager integration for Gradle using API

Set Gradle credentials

Considerations

AWS credentials with scan profile

Resolve Gradle plugins from a private Maven registry

Authenticate using mutual TLS

Fetch package manager using API

Delete package manager using API