[ProGet] Incorrect package publish date affecting policies

stevedennis

This behavior is expected, as the publish date is not carried over via a promotion.

In retrospect, it should have - but this is the sort of behavior we need to be careful about changing in a maintenance release. We'll discuss this internally and decide - please stay tuned, wehope to update by end of next week.

Thanks,
Steve

amy.j

Hi @stevedennis,

I understand, an update by the end of the week would be great - thank you!

amy.j

Hi,

Just wondering if there are any updates?

Thank you

stevedennis

Hi @amy.j,

Good news! We've decided to correct this, along with some other errant behavior with carrying over certain server-side metadata from connectors.

We are planning to ship this in the upcoming maintenance release (scheduled for August 7) via PG-3342 (FIX: Ensure correct server-side metadata (publish date, listed, deprecated) is set when adding package via pull, download, or promote from remote connectors).

This is currently in testing / code review now, asit's a bit of a riskier change. But assuming there's no issues with it, it will be available after the release.

Thanks,
Steve

amy.j

Thank you @stevedennis, really appreciated!

amy.j

Hi, it seems like PG-3342 is open and scheduled for the next release? Did something change whilst in testing?

Thanks

dean-houston

Hi @amy.j ,

Looks like the code was actually merged in and shipped, but that status wasn't reflected on the YouTrack issue, so the note didn't get added to the release.

Anyway I've modified the status and manually updated the release notes now.

-- Dean

amy.j

Hi @dean-houston,

Thanks for the update! After testing, the original issue appears to be resolved.

I did notice that aged package warnings are not appearing on the feeds I tested. Packages are showing as compliant, even where I would have expected an aged package warning. The package metadata is now more visible, which is helpful, but I was just wondering if you could confirm whether this functionality is working as expected, or if there is something I'm missing?

Thank you

atripp

Hi @amy.j ,

If the package is already cached in ProGet, then the publish date is already set. So, i would make sure to delete the package and try it again.

Otherwise, can you share more specifics? That way we can create a reproduction case.

Thanks,
Alana

amy.j

Apologies for opening this up again, would really appreciate any guidance on the below, thanks!

In our external Maven feed, org.springframework:spring-webflux 6.2.19 shows as non-compliant due to the recently published policy.
The module, sources.jar, and javadoc.jar show as published back in June (which is correct and therefore shouldn't be blocked). However, a publish date is not set for the pom file.

Once the package is actually pulled into ProGet, the pom file publish date is set to the promoted date and is therefore blocked in the external feed. Also noticed a similar issue with some NuGet packages, displaying the publish date as 01/01/1900 00:00:00. Not sure if there's a bug if the publish date metadata cannot be retrieved? For some packages, the pom file just doesn't show when you look at the external feed. If you promote, it promotes without the pom file. If you explicitly download the pom file, it then appears in the external feed and can be promoted.