Deploy Package Firewall to developer machines with MDM

​

Before you begin

• Using the Endor Labs user interface, with the Package Firewall User role. See API keys to learn more.
• Using endorctl, with the SYSTEM_ROLE_PACKAGE_FIREWALL role. Make sure to install and configure endorctl before you create the key.

• <namespace> with your namespace.
• <API key name> with the name of the API key for the Package Firewall use case.
• <YYYY-MM-DDTHH:MM:SSZ> with the API key expiration in ISO 8601 UTC format, for example 2026-12-31T23:59:59Z.

export NAMESPACE="<namespace>"
export KEY_NAME="<API key name>"

endorctl api create -r APIKey -n "$NAMESPACE" --data '{
  "meta": { "name": "'"$KEY_NAME"'" },
  "spec": {
    "permissions": { "roles": ["SYSTEM_ROLE_PACKAGE_FIREWALL"] },
    "expiration_time": "<YYYY-MM-DDTHH:MM:SSZ>"
  },
  "propagate": true
}'

​

Generate the MDM scripts

​

Upload the scripts to your MDM tool

​

How credentials are stored

export ENDOR_API_KEY_ID="..."
export ENDOR_API_SECRET="..."
export ENDOR_ATTR_USER="..."         # attributed Basic-auth username, see User attribution
export ENDOR_AUTH_B64="..."          # base64(attributed-user:secret) for npm, pnpm, yarn, and bun
export ENDOR_API_SECRET_B64="..."
export ENDOR_NPM_REGISTRY_URL="..."  # for npm and yarn 2+
export POETRY_HTTP_BASIC_ENDOR_FIREWALL_USERNAME="..."   # attributed user
export POETRY_HTTP_BASIC_ENDOR_FIREWALL_PASSWORD="..."

ENDOR_API_KEY_ID                          = <key-id>
ENDOR_API_SECRET                          = <secret>
ENDOR_ATTR_USER                           = <attributed Basic-auth username, see User attribution>
ENDOR_AUTH_B64                            = <base64(attributed-user:secret)>
ENDOR_API_SECRET_B64                      = <base64(secret)>
ENDOR_NPM_REGISTRY_URL                    = https://factory.endorlabs.com/v1/namespaces/<namespace>/firewall/npm/
POETRY_HTTP_BASIC_ENDOR_FIREWALL_USERNAME = <attributed user>
POETRY_HTTP_BASIC_ENDOR_FIREWALL_PASSWORD = <secret>

​

User attribution

​

What the scripts do

​

Configure each package manager client

• JavaScript: The scripts write _auth (base64) instead of _authToken, which bun requires. Yarn classic reads authentication from .npmrc, so the .npmrc write covers it. The scripts do not write the project-level bunfig.toml.
• Go: The scripts resolve the go env file path with go env GOENV, then write GOPROXY to it. If go is not installed, they fall back to the OS default path (~/Library/Application Support/go/env on macOS, ~/.config/go/env on Linux, or %APPDATA%\go\env on Windows). Credentials are literal because go env files cannot expand environment variables. The GOPROXY value ends in ,direct, so Go downloads a module directly from its source when the firewall does not serve it. The go env file applies to every go command regardless of shell, and it has lower precedence than the GOPROXY process variable, so project-level overrides still work.
• Python (pip): The scripts write the pip settings in a [global] section. If the file already has a [global] section, they merge the Endor keys into it, because pip rejects duplicate [global] sections. The scripts disable any conflicting keys, such as an existing index-url, with an #endor-bak# prefix and restore them when the remove script runs.
• Python (uv): uv ignores pip.conf, so the scripts write the user-level uv.toml with the firewall index URL. The scripts bake the URL in literally because uv cannot expand environment variables in its config, so it carries the attributed username.
• Python (Poetry): Poetry reads credentials from the POETRY_HTTP_BASIC_ENDOR_FIREWALL_* environment variables, so you do not need a separate write step. Add the source to your pyproject.toml: Poetry reads the registry URL from pyproject.toml and the credentials from environment variables. Add the Package Firewall as a source in each project. The source includes the URL only, never the credentials.
  [[tool.poetry.source]]
  name = "endor-firewall"
  url = "https://factory.endorlabs.com/v1/namespaces/<namespace>/firewall/pypi/simple/"
  priority = "primary"
  
• Maven: The scripts write a user-level settings.xml (~/.m2/settings.xml, or %USERPROFILE%\.m2\settings.xml on Windows) with a <mirror> of * that points at the firewall, plus a matching <server>. Credentials are not baked into the file. The <server> references ${env.ENDOR_ATTR_USER} and ${env.ENDOR_API_SECRET}, which Maven resolves at runtime from the environment variables the credential store already sets. Gradle uses this too when it reads ~/.m2/settings.xml.
• .NET (NuGet): The macOS and Linux scripts merge the Endor source into the existing <packageSources> section of ~/.nuget/NuGet/NuGet.Config. The block starts with <clear />, so the firewall replaces nuget.org and every other source listed before it. If the file lists a private feed, such as Artifactory or Azure Artifacts, the script warns and exits with code 1. Re-add that feed in a repository-level nuget.config, or use the JFrog Artifactory integration instead. Credentials are not baked into the file. The <packageSourceCredentials> entry references %ENDOR_ATTR_USER% and %ENDOR_API_SECRET%, which NuGet resolves at runtime from the environment variables that env.sh sets. IDEs launched outside a shell, for example from the macOS Dock, do not inherit env.sh, so their restores fail with a 401 error rather than bypassing the firewall.
  A repository-level nuget.config overrides the user-level file for that repository. A repository that commits <clear /> followed by nuget.org bypasses the firewall. For full enforcement, commit endor-firewall as the only public source in each repository. The key must be exactly endor-firewall so that the user-level credentials apply. A repository nuget.config that only adds a source keeps that source active next to the firewall.

​

Preserve existing configuration

# Existing configuration — never touched
legacy-peer-deps=true

# ===== BEGIN ENDOR PACKAGE FIREWALL (managed — do not edit) =====
registry=https://factory.endorlabs.com/v1/namespaces/<namespace>/firewall/npm/
always-auth=true
//factory.endorlabs.com/v1/namespaces/<namespace>/firewall/npm/:_auth=${ENDOR_AUTH_B64}
# ===== END ENDOR PACKAGE FIREWALL =====

​

Remove the configuration

.\endor-remove.ps1 -DryRun
.\endor-remove.ps1

​

Security notes

​

Generate your MDM script in the browser