[ProGet] Feature Request/Inquiry: Create 'Package Policies' through PGUtil / API

Nils Nilsson

Hi!

I'm working on automating the setup of new "workspaces" in ProGet whenever my organization onboards a new product/project.

I've been reading the documentation for a way to create a new Package Policy without the use of Web GUI actions, but turned up empty handed.

Is there a already way that I haven't found? If not, is that something you'd be willing to add to your backlog to implement?

If it is something you would consider implementing, my request is that you can set the Risk Profile during creation, in addition to the three fields available when creating in the Web Gui.

Example:

pgutil security policy create \
--Name="New Policy" \
--Priority=<'Default' | 'Before Global' | 'After Feed'> \
--Feeds="nuget-feed, maven-feed, npm-feed" \
--RiskProfile='{ \
    "Exposure" : "<External | Internal>", \
    "Interface": "<Web Browser | Unspecified>", \
    "Outage"   : "<Unacceptable | Disruptive | Tolerable>", \
    "Breach"   : "<Unacceptable | Disruptive | Tolerable>", \
    "Tampering": "<Unacceptable | Disruptive | Tolerable>" \
}'

Best regards,
Nils Nilsson

dean-houston

Hi @Nils-Nilsson ,

Thanks for the feature request; this is not currently on our roadmap.

As you might imagine, it would be a substantial undertaking to develop commands/endpoints for policy management and maintain those through new versions. Given how these will hardly change on an instance of ProGet (most users will have a handful of policies at most), we don't feel the costs bring enough benefit to users.

It's also worth noting -- SCA/Policies are still relatively new in ProGet (and the industry as a whole), so there are a lot of opportunities to improve them. We'd rather invest in that then making them API-editable (which, would make the more complex to change later as well).

Note that it's possible to do through the Policies_* endpoints and stored procedures should you really need to.

-- Dean

Nils Nilsson

Hi @dean-houston .

Thank you for your response, it makes sense that you wouldn't prioritize this, as I assume my organization is quite an outlier where we need to have one policy for every application that utilizes ProGet.

Best Regards
Nils Nilsson