This answer doesn't answer the question. Is there anything else to check or try?

Ah, I see. We have been able to reproduce this - it looks like a regression in handling the feed-specific npm adduser URL. We've also always handled the /siteroot/-/... one as well because npm used to always use that regardless of the repository URL. I think that changed some time around npm 2.7 when we added the second handler. Regardless, we've already fixed this internally (again), and will be releasing the fix as part of ProGet 3.8.1 likely some time tomorrow. Thanks for the help!

The SRCSRV stream for downloaded PDBs was always empty. Once I added that stream ProGet correctly updated it to point at itself. I never saw errors on the /administration page of ProGet. Is there somewhere else to look? I'd like to be able to skip the local indexing step if possible.

Ah, ok, that would definitely be an issue. I've added another change [PG-449] to add a new property called BaseUrl. It should be out in the next maint release.

Thanks for the bug report! We've reproduced this and have fixed the bug in one of our pgSQL functions that was causing this. We'll have the fix included in the next beta (4.0.2) which will likely be released some time today. FYI- it's the same bug preventing changing the password on that page and adding a new user; we have verified that both are now working.

Would love to see a VSIX feed (didn't see a way to vote for this feature).

Ah I missed the snapshot creation option, because I only tested an existing ProGet 3.7.x maven feed I had. The checkbox is handy when creating new feeds since it'll save the step of whipping up another feed. Since nothing appears to prevent you from creating your own snapshot repository without the checkbox, and the snapshot feed appears to be fully configurable and separate from the other repository (which one would generally setup as a RELEASE repository) so - yeah - that feature seems good to me. Thanks a ton for adding the storage location override to the next release - that's really going to be useful. Of course, now I'm getting excited... so I have to beg for feed retention rules being made available for snapshot repositories as a free version feature -- like Nexus, Archiva, etc. If that happens, my journey to the dark side will be complete. :-) I can understand the wisdom in making that a pay-for feature for most all other repository types, but at least for maven snapshots, the general industry standard is to provide some mechanism to auto-purge snapshots (keeping only the last 3 - or whatever the user specifies, etc.). I can also say that these specific improvements being made will help making a stronger case to switch binary repo managers, as well as going pro to pick up the other enterprise features. So thank you for the help and new features!

Thanks for the clarification. But then you should disable the ability to add anonymous as a group member and show a corresponding warning. With kind regards Boris Bopp

If that were to happen, then you'd need to follow the instructions here to restore it. Resetting the Default Admin Account If, due to a configuration issue, you find yourself locked out of ProGet, you can reset the built in Admin account to its default password and reset ProGet to use the built in directory by running ProGet.Service.exe and selecting the ResetAdminPassword option.

With remote connector caching enabled (default is enabled), there is almost no reason to pull a package to your feed. The reason the Pull feature is there, for example, is so you can pull down your "approved" packages, then remove the connector which in turn makes that package part of your local feed. Anyway, pulled packages are keyed by ID and version, so if a new version were released, you'd have to pull that. Check out some of the features we have planned on the Road Map which will better handle scenarios for users who pull packages often.

After updating to ProGet 3.8.1 the query http://192.168.216.1:25602/nuget/Packages()/$count?$filter=substringof('TESTTAG',Tags) now works as expected. Fixed by • PG-441 - FIX: substringof OData function arguments should be swapped Thanks.

Please see the Features by Edition page.

We're still working it... currently there are some issues surrounding the .NET 4.5 implementation in the Mono distribution, which we hope to see resolved soon!

Thanks for the additional feedback! Do keep in mind that this was simply one possible work-around for a bug in the NuGet client that they fixed more than a year ago. Also do note that, when you grant a user Feeds_AddPackage to a user, they only have access to do that task. Which in this case, is very minimal. They do not become ProGet administrators, etc. In Windows, you can actually configure all users to be "Domain Administrators" (or have "root" open in Linux). We offer the same flexibility in ProGet, and you can configure ProGet to be as secure or open as needed. This is actually a very common feature in software/vendor products and, like most software vendors, we empower users to decide how secure or open to make their instance based on their specific needs and requirements. Unfortunately we can't offer specific advice to everyone on our forums on how to decide which policies suit them, but we do have some training and certification courses which offer lots of security topics (including awareness of the "security hole" you described, as well as lots of other potential attack vectors). You seem to be quite passionate about organizational security (i.e. InfoSec), which is awesome! There's a ton of great sources out there, but I would highly recommend you follow Krebs on Security and Schneier on Security. Those are some great starting points which you can use to starting learning how to develop best practices in your own organization :)

We've finally tracked down what was causing this issue. We had two feeds configured that both had two connectors that connected back to the same ProGet server on different feeds. Turns out that this causes a very high request queue on the ProGet server, which in turn caused timeouts and eventually errors during package restore. I've now created a separate web application in IIS hosting the same ProGet folder but running on a different port and configured those two feeds to connect to the other port. This seems to alleviate the problem for now. Would be nice though if this was supported by ProGet itself. I've seen many artifact repositories that support such a feature where sort of virtualized feeds can be created by combining other feeds.

Most definitely; it's a must-have as we transition from a "private NuGet server" to a "private repository manager". I suppose we should explicitly list it under "New repository formats". I'll add a +1 to our (internal) tracker!

All fixed and I finally realized what I was doing wrong the admin password, need to learn where my uppercase characters go in passwords! Thanks, Jon

Hello. What we noticed is that when we receive this error if we delete the nuget package in the feed and then reload it the problem disappear. We still have a legacy feed. Do you think that info could be relevant?

Thanks for the report; in this case, the correct behavior is to not display the log-in form at all when Integrated Authentication is enabled, and instead give an error page indicating no access. I've logged this PG-435