Hi,

in pgscan we introduced the possibility to write an SBOM to a local output file instead of uploading it to the server using the flag '--output-file'.
Is this still possible in pgutil? I don't seem to find an option to do this.
It was always really helpful for testing purposes.

Thanks,
Caterina

Hi @rhessinger,

thank you very much! We will just wait for the next release and I will come back to you if we encounter further problems.

Thanks,
Caterina

Hi @Dan_Woolf,

thank you for the quick fix.
But the promotion call does not seem to promote the build. The build remains in its initial stage.
From pgutil I do get the feedback "Promoting BuildStageTest 1.1.0 to Test/Production/Integration". I tested it with all of our stages. But if I have a look at ProGet the build is still in the initial stage "Build".
Can you reproduce this behavior as well?

Thanks,
Caterina

Hi @stevedennis,

thank you for your response.
Maybe you can also help me with a follow-up-problem.

I created a project using

pgutil builds projects create --project=BuildStageTest

and i created a build using

pgutil builds scan --input=<path-to-sln> --project-name=BuildStageTest --version=1.1.0 --api-key=***

Those steps worked perfectly fine:

Afterwards I wanted to promote this build to another stage:

pgutil builds promote --build=1.1.0 --project=BuildStageTest --stage=Test --api-key=***

but I got an error:
Server responded with BadRequest (400): Missing required query argument: build

I really hope you can help me here as well.

Thanks,
Caterina

Hi,

I have questions regarding the usage of pgutil.

Our previous approach using pgscan was to upload an sbom which contained all necessary information. The project was automatically created.
As far as I understand, uploading an sbom with pgutil (pgutil.exe builds scan) also creates the project without explicitly creating one (pgutil.exe builds create).
Using the promote command (pgutil.exe builds promote) a build can be promoted to a different stage.
Is it possible to combine this functionality? We would love to upload an sbom directly to a specific stage. If it is not possible - have you thought about adding this functionality? Or will we have to call both commands consecutively?

Further, I have tried to create a build using pgutil but I keep getting an error.
My pgutil call looks like this:
pgutil.exe builds create --build=1.0.0 --project=BuildStageTest --api-key=*** --source=Test
And the error I get is:
Server responded with BadRequest (400): Invalid project name.
If I try to create this project directly in ProGet there are no errors. Can you reproduce this problem? Or is something wrong with my call? I am working with the latest sources from github.

Thank you
Caterina

Hi @atripp,

there are no connector errors listed in the diagnostic center and the connector itself also says there were no recent errors.

But we noticed another thing:
We have a package filter for this connector because we do not want to get DevExpress packages from this feed.

If we delete this filter, the connector packages are displayed in the feed.

As you can see it is our only filter. If we add the filter again, the connector packages are gone.
Further, we noticed this behavior already in version 2024.13. In 2024.12 everything was working fine.

Thanks,
Caterina

Hi,

we have a NuGet feed which is using a connector to NuGet ( https://api.nuget.org/v3/index.json).
Having a look at all versions of a package we are able to see local packages as well as connector packages:

We noticed that starting with version 2024.13 the packages with NuGet Connector as source were no longer showing up:

The connector itself still seems to be working. Using Visual Studio I installed a version with a local source. Afterwards I manually changed the version in my .csproj file to a version with NuGet Connector source which is not visible in my feed. Visual studio was able to successfully restore this nuget package from my feed, but the package never showed up with a local source. This creates the impression that the connector is still working but may not be displayed correctly.

Further, this is only an issue with our feed using the NuGet connector. We have several feeds using a connector (e.g. https://registry.npmjs.org) but they are showing local and connector packages.

Maybe someone can help me with this.

Tanks,
Caterina

Hi @atripp

thank you very much, downloading the latest version solved my issue.

Best,
Caterina

Hi all,

I wanted to downgrade my ProGet installation from 2024 to 2023. The documentation for ProGet 2024 says: "However, if you need to rollback to ProGet 2023, you can do so without restoring the database by simply using the Inedo Hub."
But I can not see such an option in the Inedo Hub. All i can see is an upgrade to the different versions of 2024. Maybe someone can help me with this.

Tanks,
Caterina

Hi @gdivis,

thank you very much for your response!
We are really looking forward to the finalized version :)

Thanks,
Caterina

Hi @atripp,

thank you very much for clarifying this.
We are not able to update to ProGet 2024 yet, so I will just resolve this issue manually for our projects.

Thanks,
Caterina

Hi,

we came accross an issue in some of our projects which does not really make sense to us:

If I have a look at "@types/http-proxy 1.17.14" it does not show any vulnerability:

If I have a look at the vulnerability itself, it says that this vulnerability affects package "http-proxy <1.18.1":

Could it be possible that the scope of the package is not considered in vulnerability scanning, and that "@types/http-proxy 1.17.14" leads to "http-proxy 1.17.14"?

Or is there any other reason for this vulnerability to show up in our projects?

I hope you can clarify this issue for me.

Best,
Caterina

Hi,

I was having a look at pgutil for the first time, and I appreciate that you brought the functionality to consider project references as package references into it (we introduced this feature in pgscan).
Maybe I am overlooking something, but I can not find an option to set the flag. I guess it should be settable for sbom and scan?
Please let me know if I am missing something here.

Thanks,
Caterina

Hi @gdivis,

thank you for your response.
I think it is a little bit confusing in general.

Just for clarification:
We are not using any symbol packages at all (neither .symbols.nupgk nor .snupkg). We are only embedding PDBs right into our .nupgk files. But it would be nice to strip the PDBs on package download. We can achieve this on ProGet by activating the symbol server for the legacy format.

I was just confused on why I have to use "legacy" for this approach since it is also standard to embedd the PDBs instead of using symbol packages.

I guess normally it won't be necessary to enable a symbol server if you are using embedded PDBs. But we want to see the symbol information for our packages and we want to be able to strip the PDBs on download.

It seems to be more of a hack to use the legacy symbol server for this but we achieve our goals doing so. No need to file a bug for this.

Thank you,
Caterina

Hi,

I have to ask again:
https://learn.microsoft.com/en-us/dotnet/standard/library-guidance/nuget#symbol-packages

This documentation states that it is possible to use .snupkg files or to embed the symbol files in the NuGet package (like we do it).
I can't find a documentation that says embedding symbol files is deprecated/legacy.

The documentation says: "The downside of embedding symbol files is that they increase the package size by about 30% for .NET libraries compiled using SDK-style projects. If package size is a concern, you should publish symbols in a symbol package instead."
But with the setting "Strip symbol files and source code from packages downloaded from this feed" ProGet provides for the legacy format we can avoid the problem of an increased package size.

Maybe you can evaluate further why only .snupgk files are supported as a standard?

Thanks,
Caterina

Hi @atripp,

our pull request contains a fix for the assignment of the scope to the group property of the dependency scanner.
But as already mentioned in my previous post this only fixes the appearance of the packages in the overview. The URL behind the package name is still broken.
Maybe this needs to be fixed on the ProGet-side?

Cheers,
Caterina

Hi @atripp,

thank you very much for the clarification :)

Cheers,
Caterina

Hi @atripp,

ah I see the settings were messed up. "Standard" was selected. Switching to "Mixed" made the download-button appear again.

The info window of the settings states:
"We recommend following the "Standard" approach of storing NuGet Packages and Symbol Packages (.snupkg format) in the same feed".
Would it be better to work with .snupkg files instead of embedded portable PDBs?

Cheers,
Caterina

Hi,

we are using portable PDB files in combination with Source Link for debugging purposes.
Last time I checked, I was able to download either the package itself, or the package with symbols. But I can not find the option "Download with Symbols" anymore.
Has it moved? Or is it no longer possible?

I am asking because we have a problem with debugging a specific package and I would like to download it (including its symbols) to check if the package is ok.

Cheers,
Caterina

Hi @atripp,

I investigated a little bit further:
The NpmDependencyScanner does not treat the scope of a package as a 'Group'.
I added a little code for testing:

Afterwards the packages-list of my release looks like this:

But the url behind a scoped package is still not working:

Cheers,
Caterina