Manage scan profiles

• 1: Configure scan profile through Endor Labs UI
• 2: Configure scan profile through Endor Labs API
• 3: Configure scan profile through scanprofile.yaml
• 4: Enable auto detection

endorctl scan --install-build-tools

endorctl scan

endorctl scan --install-build-tools

kind: ToolchainProfile
spec:
  os:
    linux:
      arch:
        amd64:
          java_tool_chain:
            version:
              name: "1.8.412"
              urls:
                - "https://builds.openlogic.com/downloadJDK/openlogic-openjdk/8u412-b08/openlogic-openjdk-8u412-b08-linux-x64.tar.gz"
              relative_tool_chain_path: "openlogic-openjdk-8u412-b08-linux-x64/"
              sha256_sum: "eb06c9d62e031e3290f499a828cae66d4fadbf62eb8f490c63c8406b1a80172e"
            maven_version:
              name: "3.9.4"
              urls:
                - "https://archive.apache.org/dist/maven/maven-3/3.9.4/binaries/apache-maven-3.9.4-bin.tar.gz"
              relative_tool_chain_path: "apache-maven-3.9.4"
              sha256_sum: "ff66b70c830a38d331d44f6c25a37b582471def9a161c93902bac7bea3098319"
            gradle_version:
              name: "8.4"
              urls:
                - "https://services.gradle.org/distributions/gradle-8.4-bin.zip"
              relative_tool_chain_path: "gradle-8.4/"
              sha256_sum: "3e1af3ae886920c3ac87f7a91f816c0c7c436f276a6eefdb3da152100fef72ae"
          python_tool_chain:
            version:
              name: "3.10"
              urls:
                - "https://github.com/indygreg/python-build-standalone/releases/download/20240415/cpython-3.10.14+20240415-x86_64-unknown-linux-gnu-pgo+lto-full.tar.zst"
              relative_tool_chain_path: "python/"
              sha256_sum: "add8cc6cbb4f2a3f8af2272e62b7604f7529a8c357c0af0f8a9f7d3dd444ef1e"
          java_script_tool_chain:
            nodejs_version:
              name: "20.10.0"
              urls:
                - "https://nodejs.org/dist/v20.10.0/node-v20.10.0-linux-x64.tar.gz"
              relative_tool_chain_path: "node-v20.10.0-linux-x64/"
              sha256_sum: "d3f0908a9d9190a8525c5b9a716ed91bb57e908555841b0c47f75b2a001ff91b"
            yarn_version:
              name: "1.22.19"
              urls:
                - "https://github.com/yarnpkg/yarn/releases/download/v1.22.19/yarn-v1.22.19.tar.gz"
              relative_tool_chain_path: "yarn-v1.22.19/"
              sha256_sum: "732620bac8b1690d507274f025f3c6cfdc3627a84d9642e38a07452cc00e0f2e"
          dotnet_tool_chain:
              version:
                name: "9.0.200"
                urls:
                  - "https://download.visualstudio.microsoft.com/download/pr/3606de37-1325-4f5f-bbe9-1bc44b3c1c7f/91872629e9f0c205cace9c462d5e89a4/dotnet-sdk-9.0.200-linux-x64.tar.gz"
                sha256_sum: "c07281a0abbd2c3200e70fc94d374baeadfbb43c9c3fe90c6038253555b84335"


---
kind: AutomatedScanParameters
spec:
  languages:
    - java
    - python
  additional_environment_variables:
    - ENDOR_LOG_VERBOSE=false
    - ENDOR_LOG_LEVEL=info

kind: AutomatedScanParameters
spec:
  automated_scan_parameters:
    included_paths:
      - python/**
    excluded_paths:
      - java/**
    languages:
      - python
    call_graph_languages:
      - python
    additional_environment_variables:
      - ENDOR_LOG_VERBOSE=true
      - ENDOR_LOG_LEVEL=debug
    enable_automated_pr_scans: true
    enable_pr_comments: true
    enable_sast_scan: true
    disable_code_snippet_storage: true
    bazel_configuration:
      bazel_show_internal_targets: true
      bazel_workspace_path: "go-bazel-repo/"
      bazel_include_targets:
        - "//cmd:cmd"

1 - Configure scan profile through Endor Labs UI

While scanning projects using the GitHub App, you can configure a scan profile and assign it to your projects directly from the Endor Labs user interface.

Create a new scan profile

Create and customize a new scan profile to define scan parameters, toolchains, and projects.

1. Sign in to Endor Labs and click Settings under Manage in the left sidebar.
2. Select SCAN PROFILES and click New Scan Profile.
3. Enter a name for the scan profile and click Create Scan Profile.
4. Configure various settings like automated scan parameters and paths. See Configure General scan profile settings for more information.
5. Select TOOLCHAINS and configure the toolchains. See Configure toolchains for more information.
6. Select PROJECTS to associate the scan profile with projects. See Associate projects with a scan profile.

Configure general scan profile settings

Configure the necessary scan settings to tailor scans for your projects.

1. Select the features that you want to enable for the scan profile.

   • Enable pull request scans: Automatically scans changes in the pull request.
   • Enable pull request comments: Adds scan results as comments in the pull request.
   • Disable code snippet storage for SAST: Specify the flag to disable storing the code snippet.

2. Select the languages to scan and the languages for which you need to generate call graphs.

   If you don’t select any language, all the languages detected in the repository will automatically be selected for the scan.

3. Enter the paths to include or exclude in the scan.

4. Enter any additional environment variables, if required. Only the environment variables starting with ENDOR_ are passed to the scan, all others are ignored.

5. Configure Bazel settings, if required.

   • Select Show Internal Targets as Dependencies to include internal build targets in your dependency analysis while using Bazel as your build system.

   • Configure the following Bazel settings:

     • Bazel Workspace Path: Specify the location of the Bazel workspace.

     • Target Selection: Choose one of the following methods to define which targets should be scanned:

       • Include Targets: Specify individual Bazel targets to be scanned.
       • Targets Query: Use a Bazel query expression to define the targets dynamically.

     • Excluded Targets: If using Include Targets, do not set Excluded Targets, as they cannot be used together.

   See Scan using Bazel for more details on Bazel scanning and target queries.

6. Click Save Scan Profile to save the toolchain configuration.

Configure toolchains

Create and save a scan profile.

1. Select the operating system for the scan profile.

2. Select the architecture.

3. Select the toolchain available for the operating system-architecture combination.

4. Select the tool associated with the toolchain. For package managers like Python (pip), JavaScript (npm), and Android, you can configure a list of packages to install before the scan.

5. Select the version of the tool (or enter the package name if you chose a package in the previous step) and click Add to Profile.

   You can only assign one version of the tool for a scan profile for a particular operating system-architecture combination.

   You can also click Custom and define the custom version of the tool. See Configure custom versions for more information.

   The following image shows the creation of a scan profile for Go and JavaScript scans.

6. Click Save Scan Profile to save the toolchain configuration.

Configure a custom version for a tool

When you assign a version of the tool, you can choose to apply a custom version that is not provided by Endor Labs.

You must provide the following information.

• Version name
• The URL to download the archive package
• SHA256 checksum of the package
• The relative toolchain path, if required. The toolchain is extracted to the specified relative toolchain path if provided.

The following image shows a custom configuration for the Golang toolchain with Go 1.22.7 instead of the bundled 1.22.6.

Associate projects with a scan profile

Assign projects to your scan profile.

1. Select Actions > Add Projects.

   

2. Search the project and click Add to Scan Profile. You can associate multiple projects with a scan profile, but you cannot apply multiple scan profiles to a single project.

Set a default scan profile

You can set a default scan profile for a namespace, and all projects within that namespace will use this profile. Child namespaces inherit the default scan profile unless you override it by setting a different profile as the default within the child namespace.

1. Sign in to Endor Labs and click Settings under Manage in the left sidebar.
2. Select SCAN PROFILES to view the list of scan profiles.
3. Choose a scan profile, click the vertical ellipsis on the right side, and select Set As Default.

Configure build tools

Instead of configuring a custom version for a tool every time a required version is not provided by Endor Labs, you can create a standard version and use it across all scan profiles. For example, you can add dotnet 5.0—which is not a standard supported version—to your build tools and make it available.

1. Sign in to Endor Labs and click Settings under Manage in the left sidebar.
2. Select SCAN PROFILES and click BUILD TOOLS.
3. Click New Build Tool.
4. Select the OS and Architecture.
5. Enter the required version, the download URL, and the SHA 256 checksum for verification. In advanced options, you can optionally specify a relative toolchain path. For example, you can enter these values to configure dotnet 5.0 build chain:
   • OS - Linux
   • ARCHITECTURE - arm64
   • TOOLCHAINS - .NET
   • NAME - 5.0.408
   • URL - https://builds.dotnet.microsoft.com/dotnet/Sdk/5.0.408/dotnet-sdk-5.0.408-linux-arm64.tar.gz
   • SHA256 - da88dxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
6. Use the Relative Toolchain Path to specify a custom installation directory for the tool.
7. Click Add Build Tool.

You will be able to choose this build tool in TOOLCHAINS, while creating a scan profile.

2 - Configure scan profile through Endor Labs API

You can use the endorctl api command to configure the toolchains for your project.

1. Run the endorctl scan to create a project.

endorctl scan

2. Fetch the UUID of the project, for example, to fetch the UUID of the app-java-demo project, you can use:

UUID=$(endorctl api list -r Project --filter="meta.name matches https://github.com/endorlabs/app-java-demo" --field-mask=uuid | jq -r '.list.objects[].uuid')

3. Create a ScanProfile object using the following command. Set the environment variable using set EDITOR=vim before executing the following command.

endorctl api create -i -r ScanProfile

Here is an example that you can use to create a ScanProfile object for installing .NET 8.0.303. After executing this command, you can fetch the UUID of the ScanProfile object. See Reference toolchain specification for a complete description of supported toolchains.

spec:
  toolchain_profile:
    os:
      linux:
        arch:
          amd64:
            dotnet_tool_chain:
              version:
                name: "9.0.200"
                urls:
                  - "https://download.visualstudio.microsoft.com/download/pr/3606de37-1325-4f5f-bbe9-1bc44b3c1c7f/91872629e9f0c205cace9c462d5e89a4/dotnet-sdk-9.0.200-linux-x64.tar.gz"
                sha256_sum: "c07281a0abbd2c3200e70fc94d374baeadfbb43c9c3fe90c6038253555b84335"

4. Associate the scan_profile_uuid to your project UUID project-uuid, using the following command.

endorctl api update -r Project --uuid=<project-uuid> -d '{"spec":{"scan_profile_uuid":"<scanprofile-uuid>"}}' --field-mask 'spec.scan_profile_uuid'

You have now created a toolchain for installing .NET 8.0.303.

3 - Configure scan profile through scanprofile.yaml

You can create a build tool profile for your Endor Labs scans in each repository to specify the build tools to automatically download for each scan.

Create a new file .endorctl/scanprofile.yaml file in the root directory of your repository and specify the required versions of the tools. You can specify the Operating system, architecture, automated scan parameters, language, tool, and install information in the scanprofile.yaml file:

The following snippet shows the overall structure of a scanprofile.yaml file.

kind: "AutomatedScanParameters"
spec:
  automated_scan_parameters:
      languages:
        - java
      call_graph_languages:
        - java
      additional_environment_variables:
        - ENDOR_LOG_VERBOSE=true
        - ENDOR_LOG_LEVEL=debug
      enable_automated_pr_scans: True
      enable_pr_comments: True
      enable_sast_scan: True
      disable_code_snippet_storage: True
      bazel_configuration:
        bazel_show_internal_targets: True
        bazel_workspace_path: "go-bazel-repo/"
        bazel_include_targets:
          - "//cmd:cmd"
  toolchain_profile:
      os:
        linux:
          arch:
            amd64:
              java_tool_chain:

The following example shows a scan profile to scan Java and Bazel projects in CI with Maven 3.9.4, custom environment variables, and support for both Linux and macOS toolchains.

kind: "AutomatedScanParameters"
spec:
  automated_scan_parameters:
      languages:
        - java
      additional_environment_variables:
        - ENDOR_LOG_VERBOSE=true
        - ENDOR_LOG_LEVEL=debug
      enable_automated_pr_scans: True
      enable_pr_comments: True
      enable_sast_scan: True
      disable_code_snippet_storage: True
      bazel_configuration:
        bazel_show_internal_targets: True
        bazel_workspace_path: "go-bazel-repo/"
        bazel_include_targets:
          - "//cmd:cmd"


---
kind: "ToolchainProfile"
spec:
  os:
    linux:
      arch:
        amd64:
          java_tool_chain:
            version:
              name: "1.8.412"
              urls:
                - "https://builds.openlogic.com/downloadJDK/openlogic-openjdk/8u412-b08/openlogic-openjdk-8u412-b08-linux-x64.tar.gz"
              relative_tool_chain_path: "openlogic-openjdk-8u412-b08-linux-x64/"
              sha256_sum: "eb06c9d62e031e3290f499a828cae66d4fadbf62eb8f490c63c8406b1a80172e"
            maven_version:
              name: "3.9.4"
              urls:
                - "https://archive.apache.org/dist/maven/maven-3/3.9.4/binaries/apache-maven-3.9.4-bin.tar.gz"
              relative_tool_chain_path: "apache-maven-3.9.4"
              sha256_sum: "ff66b70c830a38d331d44f6c25a37b582471def9a161c93902bac7bea3098319"
    darwin:
      arch:
        arm64:
          java_tool_chain:
            version:
              name: "1.8.412"
              urls:
                - "https://builds.openlogic.com/downloadJDK/openlogic-openjdk/8u412-b08/openlogic-openjdk-8u412-b08-mac-x64.zip"
              relative_tool_chain_path: "openlogic-openjdk-8u412-b08-mac-x64/jdk1.8.0_412.jdk/Contents/Home"
              sha256_sum: "a16d297418f6800dfc5abfd4dfd8a16c0504d7e1f3b6fc9051cf2460f14a955e"
            maven_version:
              name: "3.9.4"
              urls:
                - "https://archive.apache.org/dist/maven/maven-3/3.9.4/binaries/apache-maven-3.9.4-bin.tar.gz"
              relative_tool_chain_path: "apache-maven-3.9.4"
              sha256_sum: "ff66b70c830a38d331d44f6c25a37b582471def9a161c93902bac7bea3098319"

4 - Enable auto detection

The system can automatically detect toolchains required for your projects based on the manifest files present in your repository. Auto detection is supported for Java, Python, Golang and .NET(C#) projects. Only the Long Term Support (LTS) versions of the toolchains are supported in auto detection. See the Toolchain support matrix for a complete list of supported toolchain versions for auto detection.

Enable auto detection in CLI

To enable auto detection from the CLI,

endorctl scan --install-build-tools --enable-build-tools-version-detection

Enable auto detection in GitHub App

When using the GitHub App, you can enable auto detection either by a project or enable it for all projects in a tenant.

• To enable the auto detection by a project, update the project’s meta.annotations with "ENDOR_SCAN_ENABLE_BUILD_TOOLS_VERSION_DETECTION":"true".

meta:
  annotations: {"ENDOR_SCAN_ENABLE_BUILD_TOOLS_VERSION_DETECTION":"true"}

  endorctl api update -r Project --uuid=<project-uuid> -i

• To enable auto detection across all projects in a tenant, update the system config’s meta.annotations with "ENDOR_SCAN_ENABLE_BUILD_TOOLS_VERSION_DETECTION":"true".

 meta:
   annotations: {"ENDOR_SCAN_ENABLE_BUILD_TOOLS_VERSION_DETECTION":"true"}

 endorctl api update -r SystemConfig --uuid=<system-config-uuid> -i

The updates are applied during the next scheduled scan or whenever you perform a manual re-scan.