Troubleshoot errors

• 1: endorctl CLI exit codes
• 2: Firewall & Proxy Rules
• 3: Troubleshoot errors with DroidGPT
• 4: Scanning podman built container images

1 - endorctl CLI exit codes

The endorctl exit codes provide the result of the program’s execution, indicating whether it was completed successfully or encountered an error. This page documents the possible endorctl exit code values and the recommended next steps. When contacting support, provide the error code and the error message to help us debug the issue.

To get the exit code, run echo $? on the command line prompt.

2 - Firewall & Proxy Rules

A web proxy bypass rule or firewall rule with the following information may be required in your environment to use Endor Labs successfully.

Configure inbound access from Endor Labs’ scanning clusters for services that have IP range restrictions such as GitLab or GitHub with the Ingress rule listed above.

If you have configured integrations with third-party applications like Jira, you may need to configure additional egress rules to complete that integration. Consult the documentation for those applications to add the required rules.

3 - Troubleshoot errors with DroidGPT

Endor Labs integrates with third-party Artificial Intelligence (AI) tools to help you troubleshoot errors while performing software composition analysis, dependency resolution, or generating call graphs during an endorctl scan.

In the event of an error, DroidGPT generates explanations and actionable advice for how to resolve the error on the given host system. These suggestions are displayed as part of the error log messages on the command line and can help you understand why build errors occurred during the scan process and how to resolve them.

Enable DroidGPT error logging

Use the ENDOR_SCAN_DROID_GPT environment variable or the --droid-gpt option to enable DroidGPT error logging on your system.

• Enable error logging while performing a scan.

endorctl scan --droid-gpt

• Enable error logging while checking the system specifications required for performing a scan.

endorctl host-check --droid-gpt

Example: Here is an example of the recommendations generated by DroidGPT while scanning a Ruby repository where the manifest file is not correctly configured.

*** NOTE: Use the following AI-generated advice at your own risk ***
DroidGPT suggests the following as a possible remediation:
1. The error message indicates that there is a problem parsing the Gemfile, which is preventing the dependency tree from being generated.
2. Specifically, the error message states that there are no gemspecs at the specified location, which is causing Bundler to fail.
3. To fix this issue, you should check that the Gemfile is correctly configured and that all necessary gemspecs are present.
4. Additionally, you may want to try running `bundle install` to ensure that all dependencies are properly installed.
5. Please note that this advice is generated by an AI and there may be additional factors at play that are not captured in the error message. As such, there is no guarantee that these steps will resolve the issue, and you should proceed with caution.

4 - Scanning podman built container images

To successfully run endorctl scans on a container image built using Podman, use the following instructions:

1. Build the image using the following command. This command builds a container image and tags it with the label test:latest.

     podman build -t test:latest

2. After building the image, confirm the target registry by running the following command. Podman automatically adds localhost as the target registry for this image.

     podman image ls

3. Before scanning the image with endorctl, sign in to the target registry where the image is stored.

4. Check if there is a registry running at localhost.

5. If a registry is not running at localhost, then you must re-tag the image to a reachable registry, using the following command. Replace <reachable-registry> with the actual URL of an accessible registry.

     podman tag test:latest <reachable-registry>/test:latest

6. Sign in to the reachable registry using any container runtime. Now you can run the endorctl scan. Targeting a reachable registry lets you locate the image manifest and download all required layer blobs for vulnerability analysis.