rust

Rust

Rust is a software programming language widely used by developers. Endor Labs supports scanning and monitoring of Rust projects. Using Endor Labs, application security engineers and developers can:

• Scan their software for potential security issues and violations of organizational policy.
• Prioritize vulnerabilities in the context of their applications.
• Understand the relationships between software components in their applications.

System specifications for scan

Make sure that you have a minimum system requirement specification of an 8-core processor with 32 GB RAM. Use a system equipped with either Mac OS X or Linux operating systems to perform the scans.

Software prerequisites

• Install the following prerequisites:
  • Package Manager Cargo - Any version
  • Rust - Any version,
• Install Bazel version 5.x.x, 6.x.x, 7.x.x, 8.x.x, or 9.x.x if your project uses Bazel. Bazel support requires aspects (--use-bazel-aspects). Endor Labs supports Bzlmod with Bazel aspects. See Bazel for more information.
• Make sure your repository includes one or more files with .rs extension.
• Install Rust using the latest rustup tool.

Build Rust projects

Ensure your repository has Cargo.toml file and run the following command making sure it builds the project successfully.

cargo build

If the project is not built, endorctl will build the project during the scan and generate the Cargo.lock file. If the repository includes a Cargo.lock file, endorctl uses this file for dependency resolution and does not create it again.

Scan Bazel projects

To scan Rust projects that use Bazel, see Bazel for build instructions, supported rules, and scan commands. Bazel support for Rust requires aspects using rules_rust >= 0.40.0. Bzlmod is also supported. See Bazel Aspects for more information.

Run a scan

Perform a scan to get visibility into your software composition and resolve dependencies.

endorctl scan

You can perform the scan from within the root directory of the Git project repository, and save the local results to a results.json file. The results and related analysis information are available on the Endor Labs user interface.

endorctl scan -o json | tee /path/to/results.json

If you use Endor Labs with an EU tenant, use https://app.eu.endorlabs.com instead of https://app.endorlabs.com.

Understand the scan process

Endor Labs resolves dependencies for the package version when it scans Rust projects.

Resolving Dependencies

Endor Labs leverages the Cargo.toml file in Rust and uses this file to build the package version using Cargo. Endor Labs uses the output from cargo metadata to resolve dependencies specified in Cargo.toml files and construct the dependency graph.

Known Limitations

• Call graphs are not supported for Rust projects.
• Scanning Rust projects on the Microsoft Windows operating system is currently unsupported.

Troubleshoot errors

• Host system check failure errors: These errors occur when Rust is not installed or not present in the path variable. Install Rust and try again.