Welcome to the Inedo Forums! Check out the Forums Guide for help getting started.
If you are experiencing any issues with the forum software, please visit the Contact Form on our website and let us know!
Proget License and Vulnerablility scanning
-
Does the License and Vulnerability scanning scan the artifacts/projects that are uploaded to Proget or only prevent downloading of artifacts/projects through Proget.
For example, if I have a Java project that pulled in dependencies directly from maven central rather than going through a proxied feed through Proget. It would be able to include a dependency with a prohibited license. Would the artifact that gets created for this project then be scanned when uploaded to Proget and the prohibited reference found?
Or, is it the case that in order to prevent inclusion of prohibited licences we need to have all dependencies pulled through Proget feeds to prevent them being downloaded in the first place?
Product: ProGet
Version: 5.2.0-beta.33
-
In order to prevent inclusion of prohibited licences, you will need to have all dependencies pulled through ProGet feeds to prevent them being downloaded in the first place. This also serves as a quality gateway, to ensure low-quality packages/components aren't introduced into your projects.
You can enforce this at the build server (for example, with BuildMaster): simply have your build server always use ProGet as the only dependencies source, and this way if developers try to bypass ProGet, it simply won't build.