@stevedennis Our use case is for first-party, proprietary packages developed by Alkami and it's customers/partners with the ability to share those packages with others. I'm not aware of any source other than pub.dev but I'm sure there are companies running their own internal instance of the pub.dev site (we are). The benefit of a private repository is limiting who has access to our proprietary packages which includes all of the source code which is included in the package since Flutter doesn't support binary libraries.

UPDATE: ProGet 2024.11 added support for pub (Dart/Flutter) Feeds!

In December 2018, Google released the 1.0 version of Flutter and adoption has been growing exponentially since it's release. Flutter is a cross-platform development framework that leverages the Dart language similar in concept to React-Native. Flutter supports the development of a single code base that runs across all platforms (iOS, Android, Web, Windows, MacOS, Linux). Pub.dev is the public repository for hosting packages.

We have recently adopted Flutter for our mobile development framework and are looking for how to host packages in a private feed similar to the way we have feeds for nuget and NPM packages using Proget.

While I understand the difficulties of supporting a new feed type, the source code for pub.dev is freely available on Github which should make it easier to reverse-engineering. The format of the package is well defined and it's package format is just a tar.gz file with a manifest.

We strongly believe we are only at the beginning of the adoption curve for Flutter and we will see even more expansive growth in the user community over the next year. It would be great if Proget was leading that adoption by adding a feed type supporting the pub.dev protocol.~~

I have recently integrated our Whitesource account to Proget to leverage the ability to prevent packages with vulnerabilities from being downloaded. I've gone to a feed and added a Package Access Rule for Whitesource. I expected it to start blocking downloads of the libraries that have been identified as vulnerable but it is not working. Is there a way to troubleshoot the issue and see that Proget is actually calling the Whitesource API?

I have configured the Endpoint as https://saas.whitesourcesoftware.com/agent. Is that correct or should it be configured for the API (https://saas.whitesourcesoftware.com/api/v1.3)?