Skip to main content
Rust is a software programming language widely used by developers. Endor Labs supports scanning and monitoring of Rust projects. Using Endor Labs, application security engineers and developers can:
  • Scan their software for potential security issues and violations of organizational policy.
  • Prioritize vulnerabilities in the context of their applications.
  • Understand the relationships between software components in their applications.

​
System specifications for scan

Make sure that you have a minimum system requirement specification of an 8-core processor with 32 GB RAM. Use a system equipped with either Mac OS X or Linux operating systems to perform the scans.

​
Software prerequisites

  • Install Cargo and the Rust compiler (rustc), and make sure both are on your PATH. You can install them with rustup or another installer.
  • Make sure your repository includes a Cargo.toml file.
Endor Labs does not require a specific Rust or Cargo version. Use a Cargo version that supports the manifest and lockfile features your project uses. The following table lists the first Cargo version that supports each project feature.

​
Prepare Rust projects

Commit your Cargo.lock file so scans use the same dependency versions as your builds. If Cargo.lock is missing, Cargo creates one during the scan, which needs access to crates.io or your private registry. To confirm that Cargo can resolve your dependencies, run the following command in each directory that contains a Cargo.toml file.

​
Run a scan

Perform a scan to get visibility into your software composition and resolve dependencies.
You can perform the scan from within the root directory of the Git project repository, and save the local results to a results.json file. The results and related analysis information are available on the Endor Labs user interface.
Sign in to the Endor Labs user interface, select Projects from the left sidebar, and find your project to review its results.
If you use Endor Labs with an EU tenant, use https://app.eu.endorlabs.com instead of https://app.endorlabs.com.
To scan Rust projects built with Bazel, see Bazel.

​
Understand the scan process

Endor Labs resolves dependencies for the package version when it scans Rust projects.

​
Resolving Dependencies

Endor Labs runs cargo metadata with all features enabled in each directory that contains a Cargo.toml file. It uses the output to resolve the dependencies in your Cargo.toml files and construct the dependency graph. Cargo workspaces are supported.

​
Supported targets

Endor Labs scans library and binary targets and creates a package version for each one. It scans libraries of every crate type, including lib, rlib, dylib, cdylib, staticlib, and proc-macro, and counts a target with more than one crate type, such as crate-type = ["cdylib", "rlib"], once. It does not scan examples, tests, benchmarks, or build scripts. For a description of each crate type, refer to the Rust compiler documentation.

​
Known Limitations

  • Call graphs are not supported for Rust projects.
  • Scanning Rust projects on the Microsoft Windows operating system is currently unsupported.

​
Troubleshoot errors

If cargo metadata fails, Endor Labs reports a dependency resolution error for the project. Run the command in Prepare Rust projects to see the Cargo error, fix it, and scan again. If Cargo is not installed or not on your PATH, install it and scan again.