Execption when running VulnerabilityDownloader Scheduled Task - using Clair

[scroak_6473]

Hi @rhessinger

Sorry I should have included that I do have the https:// specified.

Thanks

Simon

[rhessinger]

Hi @scroak_6473 ,

Do you have any other vulnerability sources setup? Or just clair?

Thanks,
Rich

[scroak_6473]

Hi @rhessinger

Just Clair

Simon

[rhessinger]

Hi @scroak_6473 ,

Everything looks to be correct. Can you try removing your vulnerability source from your Docker feed, then delete the vulnerability source then re-add it again and reassociate it to your feed? The only thing I can assume from that error stack trace is it is failing to parse the Configuration for your vulnerability source.

Thanks,
Rich

[scroak_6473]

Hi @rhessinger

Removed and re-added but the same problem persists. Even updated to v5.3.5 and issue is the same.

Is there any other logging I can get for you? Any way I can see what calls are being made to Clair?

Thanks

Simon

[rhessinger]

Hi @scroak_6473,

I was hoping recreating the source would fix it. Based on your error, it looks like the error happens before it even attempts to call Clair. If it made at least one call to Clair, your output would look similar to this:

Can you provide a screenshot of your extensions page? I would like to verify the extension versions. Also, could you screenshot your Manage Feed -> Detection & Blocking tab?

Thanks,
Rich

[scroak_6473]

Sure @rhessinger

Extensions:

Manage Feed:

Thanks

Simon

[rhessinger]

Hi @scroak_6473 ,

I working on reproducing this locally, but I'm running into some issues with my local Docker installation. I'll reply once I run some local tests. The majority of my testing for Clair has been done using the windows IIS or integrated web service installs.

Thanks,
Rich

[scroak_6473]

Hi @rhessinger

Any update on this issue?

Thanks

Simon

[rhessinger]

Hi @scroak_6473,

We are still working on the issue. It looks to be only an issue with the ProGet docker image, but I don't have a lead on why yet. If you have the ability to install this on windows, I can confirm it is working there. I know you are running a free trial of ProGet. If you need to extend the trial because of this issue, please contact us through https://inedo.com/contact.

Thanks,
Rich

[rhessinger]

Hi @scroak_6473.

I have been able to recreate the error and I can confirm that this is only an issue with running ProGet in docker. I'm currently working to fix this issue.

Thanks,
Rich

[scroak_6473]

Hi @rhessinger

That's amazing Thanks. Let me know what version the fix will be in.

Thanks

Simon

[rhessinger]

Hi @scroak_6473,

So I finally figured it out. Our ProGet docker image actually runs mono to run ProGet. Apparently this is an issue with the new way we load extensions in mono. I have put a fix in the next version of ProGet (5.3.6), but if you would like to leverage it now, you will just need to change a config value. Just navigate to Administration -> Advanced Settings and locate the value Extensions.UseNewExtensionLoader and uncheck it and save. Then you will need to restart your docker image, i.e. sudo docker restart proget. Then the vulnerability source should start working, or at least show you any real issues you have.

Thanks,
Rich

[scroak_6473]

Hi @rhessinger

I can confirm that this fixes the issue! Thanks so much for all your help!

Simon

[rhessinger]

Hi @scroak_6473,

Glad to hear it!

Thanks,
Rich