Request for Creation of API for Package Auditing Before Dependency Restoration

stevedennis

In retrospect, I don't think pgutil would display the output like that exactly, but you get the idea. It'd basically be a bunch of label/text pairs -- basically not that different from what's in the ProGet UI

pmsensi

@stevedennis

Re: Get package license with ProGetClient

the pgutils packages metadata + API end point to be used in Inedo.Proget lib is what I need :)

Do you have a timeline for the implementation ?

Best Regards,
Pedro

fabrice.mejean

Hi @stevedennis,

I agree with your proposal; it should allow me to meet my current needs.

Regarding obsolescence management, unfortunately, the majority of open-source components do not manage obsolescence, let alone end-of-life dates. That is why we mark all packages older than 3 years as obsolete. This allows us to verify that the open-source project is still alive, and that in case of a vulnerability, we are still able to carry out a corrective version upgrade. I will certainly create another post about this soon, but it gives you something to think about.

I would appreciate a YouTrack reference to track this feature.

Thank you again.

Fabrice MÉJEAN

atripp

Hi @fabrice-mejean @pmsensi ,

We've got this spec'd out and on the roadmap now as PG-3126! It'll come through a maintenance release, along with pgutil security commands for configuring users, groups, and tasks.

The target is 2025.13, which is planned for October 24. I don't know if we'll hit that target, but that's what we're aiming for.

Please check out the specs on PG-3126; I think it captures what you're looking for, which is basically an expanded metadata object that includes compliance data, detected licenses, and vulnerabilities.

Thanks,
Alana

pmsensi

@atripp Looks good!

For my clarification, the property DependencyGroups, will be a list of all the (main) dependencies of the package ?

Best Regards,
Pedro

atripp

Hi @pmsensi,

Correct -- it'll be whatever data is on the "Dependencies" tab in ProGet, which is basically whatever is in the manifest file (.nuspec, etc).

Thanks,
Alana

pmsensi

Hello @atripp

Sorry to open an old topic.

While checking the content of the result of GetPackageMetadataAsync (PackageMetadata), I don't see any reference to the Dependencies.

The public APi has changed ? Or there is a new way to get the dependencies information ?

Best Regards,
Pedro

atripp

Hi @pmsensi,

I don't believe that was ever in the PackageMetadata object; that information is stored in ecosystem-specific formats inside of the manifest file (e.g. .nuspec) in the package and it's not something we can easily generalize. The UI shows a "simplified" version but it's not always correct or suitable for metadata/api results.

You'd have to parse those metadata files to get that information.

hope that helps,

Alana

pmsensi

Hello @atripp ,

oh ok, I thought that will be available, reading your last reply from last year.

Anyway, that information is not even stored in database ?, so means, I need to use the Nuget api to get that information ?

Best regards,
Pedro

atripp

Hi @pmsensi ,

Oh sorry I didn't realize or notice it when reviewing the reply. We decided not to include it after all, mostly because we couldn't realistically model/generalize the data across ecosystems when it comes to things like how NPM handles dev-level dependencies, how PyPI handles environment dependencies, etc. The UI display garners a decent number of "complaints" because it doesn't represent it the same way as say, npmjs.org for example.

That said, the manifest file (i.e. .nuspec) is cached in the database, but there's no "ProGet" API to retrieve that.

You'd have to use the NuGet-specific API for that, or just download the package file and then extract the .nuspec file.

Thanks,
Alana