Private package manager integration for Packagist

Learn how to configure Endor Labs to access private Packagist repositories for dependency resolution and security scanning.

This is the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

Learn how to configure Endor Labs to access private Packagist repositories for dependency resolution and security scanning.

Configure Endor Labs to integrate with private Packagist repositories to access proprietary dependencies during security scanning and analysis. When your PHP projects depend on packages hosted in private or corporate Packagist repositories, Endor Labs requires authentication credentials to resolve these dependencies and generate a complete bill of materials.

This integration enables Endor Labs to:

Access private Packagist packages during dependency resolution
Generate comprehensive security analysis including private dependencies
Maintain complete visibility into your software supply chain

Endor Labs integrates with your self-hosted package repositories and source control systems to give you visibility into your environment. Package manager integrations allow users to simplify scanning using custom repositories.

Endor Labs generally respects package authentication and configuration settings and a package manager integration is usually not required to scan private packages successfully.

Use package manager integrations to simplify scanning when authentication to private repositories is not part of standard manifest or settings files.
Package manager integrations allow you to set custom repositories for each package ecosystem and the priority of each repository for scanning.

To set up a package manager integration:

Sign in to Endor Labs and select Integrations from the left sidebar.
Click Manage in the package manager configuration you want to customize.
Select Add Package Manager.
Enter the name of the package manager.
Select either Basic or AWS Code Artifactory as Authentication Type.

See AWS authentication for more information.

Authenticate to Packagist private package repositories

To connect to private repositories of Packagist enter the package manager URL and the package registry credentials such as username and password.

Basic Authentication for package manager integrations

Select Integrations from the left sidebar.
Click Manage in the package manager configuration you want to customize.
Click the vertical three dots of the package manager configured and select Test Connection.

Note

The integration does not perform authentication or authorization checks on the package manager repository.

Package manager integration for Packagist using API

Run the following command to create a package manager resource and authenticate to Packagist repository.

Replace:

username with your package registry username.
xxxx with your package registry password.
namespace with your namespace.
your host with your package manager host. For example, "host": "repo.packagist.com".

endorctl api create  -r PackageManager -n <namespace> -d '
{
    "meta": {
        "name": "test packagist",
        "description": "test packagist"
    },
    "spec": {
        "packagist": {
           "auth_kind": "AUTH_KIND_HTTP_BASIC",
            "host": "your host",
            "user": "username",
            "password": "xxxx"
        }
    },
    "propagate": true
} '