Navigation

    Inedo Community Forums

    Forums

    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Groups
    1. Home
    2. dan.brown_0128
    3. Topics
    D
    • Profile
    • Following
    • Followers
    • Topics
    • Posts
    • Best
    • Groups

    Topics created by dan.brown_0128

    • D

      Debian feed mirror Performance
      Support • • dan.brown_0128  

      8
      0
      Votes
      8
      Posts
      32
      Views

      S

      @stevedennis thank you for the update and insights. Looking forward to what Q4 (or later) will bring!
    • D

      OCI Support for Assets
      Support • • dan.brown_0128  

      5
      0
      Votes
      5
      Posts
      23
      Views

      D

      Hey @stevedennis - From that quote, I get the sense that the container feeds were implemented by trying to force the process into what was implemented for traditional file-based packages rather than treating container images as a different style of artifact. This would explain why it seems OCI isn't a direct drop in fit -- because other traditional package consumers (pypi, nuget, maven, etc) do not behave the same as OCI. As for the scalability comment - I can see your point if you tried to cram traditional package types into OCI where the client doesn't support that. Could clients like nuget support OCI for downloading the nupkg files? Sure. But they haven't so far as I know. On the shock that for container images that you have to provide the URL to access the image -- that's not all that different than traditional software packages. Just on those traditional package tools you're specifying that URL Prefix as part of the client's configuration. The client may add in some "middle parts" to that url. And actually you do run into that some with docker: If you take the common nginx-ingress image hosted on DockerHub, the image name is just nginx/nginx-ingress which works just fine in docker and kubernetes deployments. Secretly, that full image URL parses out to docker.io/library/nginx/nginx-ingress. Last one -- The URL thing. Take a look at some other common registries, including the public GitHub container registry. For those, the URL is always ghcr.io but they then prefix the image with the User/Org (eg: https://github.com/blakeblackshear/frigate/pkgs/container/frigate/394110795?tag=0.15.1). Truthfully, Proget could do a similar approach: proget.corp/MyOciOrDockerFeed/image/path/here:1.2.3
    • D

      SCA Feedback/suggestions 2024
      Support • • dan.brown_0128  

      5
      0
      Votes
      5
      Posts
      19
      Views

      D

      The reason for blocking application packages like this, that have vulnerable dependencies, comes down to security governance. While yes, it can be inconvenient if a package that has worked before is now blocked, that does prevent us from introducing known vulnerabilities into our environment. In the event of an emergency deployment (ex prod rollback, etc), we could apply a temporary exemption to allow the package to still deploy -- after doing a risk assessment. To use the log4j example again -- if we have an application that was built with a vulnerable version of log4j, nobody would want that package to get deployed again (while also remediating it anywhere that it was already deployed). From what I can tell the most effective way would be to block the download from ProGet - if we can leverage it's automatic blocking functions. Adding the audit into the deployment process is definitely one way to partly add this security layer but it'd require active implementation for all of our deployments, and opens more opportunity for teams to skip or work around it. Basically its better than nothing yes, but it's not the most effective security enforcement measure.
    • D

      Infrastructure As Code Scanning -- Azure ARM/Bicep
      Support • • dan.brown_0128  

      2
      0
      Votes
      2
      Posts
      16
      Views

      atripp

      Hi @dan-brown_0128 , It doesn't look like there's been much interest in this so far (we haven't heard any othe rrequests for it), but I wanted to mention that Terraform repositories are planned and something we hope to accomplish in the coming months. Cheers, Alana
    • D

      NPM Vulnerability with Exception
      Support • • dan.brown_0128  

      4
      0
      Votes
      4
      Posts
      14
      Views

      stevedennis

      @dan-brown_0128 I understand So you'd either have to upgrade (where we fixed the code) or reassess it to Low so npm audit won't crash. I suppose you could also patch npm audit so it doesn't crash.
    • D

      NPM Package name case sensitivity
      Support • • dan.brown_0128  

      10
      0
      Votes
      10
      Posts
      35
      Views

      stevedennis

      Hi @pbspec2_5732 , The script in the linked gist should fix the problem for you; it's not feasible/possible to try editing in the database directly due to the complexity of the model. https://gist.github.com/apxltd/351d328023c1c32852c30c335952fabb Thanks, Steve
    • D

      Debian Feed - Package can only be downloaded by apt once
      Support • • dan.brown_0128  

      12
      0
      Votes
      12
      Posts
      34
      Views

      gdivis

      Great to hear! Thanks for the followup
    • D

      Debian Feed (New) connector errors
      Support • • dan.brown_0128  

      13
      0
      Votes
      13
      Posts
      44
      Views

      D

      I was finally able to try this with a mounted network drive (using SysInternals), and that works
    • D

      Debian Feeds and PGVC
      Support • • dan.brown_0128  

      2
      0
      Votes
      2
      Posts
      8
      Views

      stevedennis

      Hi @dan-brown_0128 , Yes, but only once you've enabled ProGet 2024 Vulnerability Preview features (available in ProGet 2023.29+). Thanks, Steve
    • D

      PGVC URLs
      Support • • dan.brown_0128  

      2
      0
      Votes
      2
      Posts
      13
      Views

      atripp

      Hi @dan-brown_0128 , The latest version includes a migration tool, so I would recommend using that. The URL has been changing throughout ProGet 2023, but you will be safe whitelisting cdn.inedo.com and security.inedo.com. This is only required for downloading updates, as it's an offline database that ships with ProGet. Cheers, Alana
    • D

      Link between SCA Project and Package
      Support • • dan.brown_0128  

      6
      0
      Votes
      6
      Posts
      30
      Views

      rhessinger

      Hi @dan-brown_0128, The only linkage between the SCA project and the NuGet package/feed (and other feed types when associated) is that the SCA project will look at all the associated NuGet packages' feeds to pull their relevant license and vulnerability data for each associated package. The then displays that information in the SCA project and creates issues if it finds problems (blocked license, blocked due to vulnerability, missing package, etc...). Thank, Rich
    • 1 / 1