Hi @stevedennis ,

using ?bypassIntegrated=false lets me download the package from the UI.
Is this something you can fix?
For now I can share this information with my colleagues.

Offtopic (since we are already talking):
We recieved your Inedo snackbox this week and we love it

Thanks,
Caterina

Hi @stevedennis ,

the thing is that microsoft states that windows authentication is great for internal applications integrating the Active Directory: https://learn.microsoft.com/en-us/aspnet/core/security/authentication/windowsauth?view=aspnetcore-10.0&tabs=visual-studio
I can not find a documentation telling me to switch to token-based authentication.
It is also easier to maintain, because the AD is already managed. To manage tokens for each person that is allowed to access ProGet would take up extra effort.

Either way, we moved away from hostname-binding and then we are able to use "npm install" for example.
But a new problem occured:
If I go to the ProGet UI, into one of our npm feeds and try to download a npm package using the download button, i get an Unauthorized error:

So I can see the packages, but I can not download them, eventhough the permission is "View and Download packages"

Can you help me here as well?

Thanks,
Caterina

Hi @stevedennis ,

thank you for your reply. I still have some questions.

When talking about WIA are you only talking about NTLM?
What we do is using Kerberos to make sure specific AD-groups have access to our packages. Not everyone is allowed to view/download packages. Going with no authentication is not an option for us.
I can not find a documentation that states that Kerberos is discontinued. Maybe you can provide me with sources? Or maybe we are talking about different things when talking about WIA

Right now our process is that a user is authenticated if he is in a specific AD group and wants to access nuget packages, and he needs an api key to access npm packages.

If I install ProGet 2025 with integrated web server and activate WIA in the settings, I am no longer able to make e.g. "npm i" because the authentication fails:

Which makes sense, because npm is not supporting WIA, but I was hoping ProGet manages this under the hood when switching to integrated web server.

Our ProGet instance is bound to a hostname and a port.

I already tried to explicitly disable WIA for our npm feeds, but it does not seem to be working.

Is there another setting I am missing?

Thanks,
Caterina

Hi all,

we are trying to update from ProGet 2024 to ProGet 2025.
As I understood the documentation we have to move from IIS to integrated web server.
Right now we are running ProGet on two IIS sites. One where windows authentication is enabled and one where it is disabled (necessary for npm).
Is this still possible when moving to Integrated Web Server?
We need to keep the windows authentication but I am not sure if our npm tasks will continue working.
Maybe you can clarify that for me.

Thanks,
Caterina

Hi all,

we tested the .slnx support of pgutil and noticed that pgutil can only detect projects that are a direct child of the root element.
If the .slnx structure is more complex, projects are not found.

E.g:
Both projects are detected by pgutil:

No projects are being found:

Since it was a quick fix, we created a pull request for it:
https://github.com/Inedo/pgutil/pull/25

Please have a look at it and let us know if you can confirm the behavior.

Thanks
Caterina

Hi @stevedennis,

thank you.
It looks like you guys created a seperate repo for ConsoleMan:
https://github.com/Inedo/ConsoleMan

I guess this one creates the NuGetPackage?

Thanks,
Caterina

Hi all,

I got the latest source code of pgutil and wanted to compile it.
Unfortunately, I get the error that the package 'ConsoleMan' can not be found.
I know that there was the project 'ConsoleMan' in previous versions but it seems like it has been removed.

Is there something special I have to do to build the solution? Maybe I am missing something.

Thanks
Caterina

Hi @atripp,

so as far as I understood it, one should not tag packages with the latest Tag themself, npm handels that tag.
If no specific tag is given, "npm publish" gives the latest tag to the last uploaded version. And if a new version is uploaded without a specific tag, this version gets the latest tag and it is being removed from the former package.

But we would also lose the tags if we manually tag them. Maybe we want to separate between testversions and productionversions with tags. Just a thought. We also lose this tag during promotion.

So maybe you can not only promote the latest tag but all tags? To lose information about a package is always bad I guess.

Tanks,
Caterina

Hi all,

we noticed that some of our npm packages are missing its tags.
Having a closer look at that issue we noticed that the tags are lost during promotion.
Usually, we upload our packages with the tag "latest" to a testfeed. After testing we promote the package to our live feed. In the testfeed we can see the tag, in the live feed the tag is missing.

Testfeed:

LiveFeed:

We usually promote packages using the api but it also happens when we manually promote packages.

We also noticed that manually adding a npm package is not saving the tag. In the upload window you already suggest the tag "latest" so we just leave it:

But the tags are empty after the upload:

We noticed this behavior because we are using "npm outdated" to check if there are newer versions of installed npm packages. This command scans registries for the package with the tag "latest" but we never got any suggestions for our packages.

Can you verify this behavior?

Thanks,
Caterina

Hi @rhessinger,

thank you for pointing out the feed features. License detection was not enabled in the feed I used for testing. After activating the feature the package is being reanalyzed correctly and the global policy is being used.

Thanks
Caterina

Hi Steve,

thanks for clarifying things.
I was just wondering: If I create a feed policy the UI looks like that:

I set "PolyForm-Noncommercial-1.0.0" as compliant for the feed but it is noncompliant in the global policy. The noncomliant part of my global policy is crossed out completely. Does that mean it is ignored? Or is that a UI issue because only "PolyForm-Noncommercial-1.0.0" should be crossed out?

I also tried to use the Reanalyze Task with the following result (The package has the license "PolyForm-Noncommercial-1.0.0"):
In the feed "NuGet" (the original feed of the package) I see this log:

If I reupload/promote this package to another feed and reanalyze it I see this log:

It looks like the global policy is not being considered? A policy is being found but it does not seem to be applied?

Maybe you can tell me more about that behavior.

Thanks
Caterina

Hi all,

we tried to work on global and feed policies and we do have some questions regarding this topic. We are currently working on Version 2024.38.

If a feed policy is active, will the global policy also be evaluated when analyzing the packages in this feed? Or will the global policy completely be ignored?

Let's work with an example for our next question:
I have a feed called "NuGet". This feed contains the package "EPPlus 6.0.6" which has the license "PolyForm-Noncommercial-1.0.0".
In my NuGet policy i set this license as "Compliant" and in my Global policy i set this license to "Noncompliant".
Is it correct to assume that the package will by Compliant in the feed "NuGet" but should be Noncompliant in any other feed?
Because if I upload the package to another feed (which has no specific feed poilcy) the package is listed as compliant:

If I remove the feed policy, this package is shown as Noncompliant in this specific feed. But if I reupload or promote it to another feed it is shown as Compliant. So maybe this has nothing to do with the policies, but not sure.

In general we are just curious about how the policies interact with each other.

Thanks
Caterina

Hi all,

we are still evaluating if we should move from ProGet 2023 to ProGet 2024 and we noticed some missing information:
We are currently using pgscan to upload the SBOMs for our projects. We also provide the project-type (usually "application" or "library"). We provide this information because we are actively working with it. The SBOM on ProGet 2023 looks like this:

The SBOM of the same project after migrating to ProGet 2024 looks like this:

We lost the information about the project type which is not acceptable for us.

I thought that it might be a problem of the migration, so I explicitly used pgscan to upload an SBOM directly to ProGet 2024. Same problem. the project-type is Null. Then I thought, ok maybe it is a problem with pgscan in combination with ProGet 2024 so I used pgutil to upload an SBOM. Same problem. We lose the information about the project type.

Also the timestamp behaves different. The timestamp on ProGet 2023 is the timestamp of the creation of the SBOM and is always the same. The timestamp on ProGet 2024 is the timestamp of the download of the SBOM and is different each time I download the same SBOM.

Can you confirm this behavior? Or am I doing something wrong maybe?
Unfortunately, losing this information will definitly block our migration.

Thanks,
Caterina

Hi,

I have a question regarding the SCA & Build Restrictions of ProGet 2024 in the Basic edition.
We are still using ProGet 2023 because of the limitation for 1000 active builds.
Is this limitation only for the Package Analyzer?
Or will there be an error once i have 1000 active builds and try to create one more?
Or am I able to upload sboms for more than 1000 builds and have the information about used components but am not able to scan for issues?

Where exactly would this limit hit us? Because we do have more than 1000 active builds and there are new ones each day.
Would an upgrade be possible? Or is the limitation for 1000 active builds a hard limit?

Thanks,
Caterina

Hi,

it looks like the notifier is still being triggered if there are 0 issues in 2024.31.
Can you confirm this? Hoped it had been fixed by now.

Thanks,
Caterina

Hi @dean-houston,

thank you for your response. Using your provided template the webhook is working.

The webhook is being triggered several times, but the issues property always has an empty array:

If I have a look at this specific build, the issues tab does not show any issues:

Can you tell me why exactly the "issues opened on build"-notifier is being triggered by this build?
We do have a lot of this cases.

Thanks,
Caterina

Hi @stevedennis,

as mentioned in my initial post, no customizations have been made:

The package event notifier are working this way.
I also tried to use the template from your documentation (https://docs.inedo.com/docs/proget/administration/proget-notifications-webhooks), but we got the same error:

Hope this helps.

Thanks,
Caterina

Hi,

we are trying to introduce a new notifier in ProGet Version 2024.25 (Build 11).
We are already using a custom webhook which notifies us if a package has been added.
Now we wanted to create a webhook that notifies us if a issue has opened on one of our builds.

No special settings have been made, just basic selections. Using the default settings would be fine for first tests.
The documentation for this type of notifier says that it is being triggered after the ComplianceAnalyzer scheduled job has been run. So I did that, but afterwards I got an error on my notifier:

Accessing the same webhook with a package notifier works just fine, so it seems to be an issue with this specific sca event notifier.

Is it necessary to make specific settings for this type of notifier? Or can you confirm that there is an error?

Thanks,
Caterina

Hi @rhessinger,

sorry for the late response, this somehow slipped my mind.

Your suggestion looks good to me. The description is easy to understand and also the parameter name is very descriptive.

Thanks,
Caterina

Hi @atripp,

I was able to test the new version of ProGet and there still seems to be a weird behavior.

Again I am using my test-project 'BuildStageTest'. I deleted all existing builds to give it a "fresh start".
Creating a build via SBOM upload seems to be working fine. This way I created build 1.0.0:


As you can see, there are no other builds in my project.

If I try to create the same version via "Create Build" you display an error (which is great):

But if I try to manually create build 2.0.0 I get the same error even if the build is not existing:

I thought that there might be an issue because build 2.0.0 already existed in previous tests. But I deleted all builds as you can see from the ui and the database screenshots above.
So I also created a completely new project and tried to manually create builds. But for some versions i do get the error message (I was not able to manually create 1.0.0, 2.0.0, 4.0.0, but some other versions were working just fine):

Are you able to reproduce this behavior?

Thanks,
Caterina