Topics created by parthu.reddy

Hi @parthu-reddy , This hasn't changed; to "Set Package Status", you need to first Pull the Package to the feed. From there, you can a compliance rule override of Always Block or Always Allow Downloads. Thanks, Alana

Hi @parthu-reddy , If you can provide my with some step-by-step instructions (reproduction case), then I can see if if there's a bug in ProGet. However we can't really change the "license file is embedded in the package file" technical requirement. That said... using custom licenses for blocking package is definitely inappropriate. Please do not do that. It will cause you headaches and probably business disruptions later. There are already tools to prevent users from downloading packages from ProGet, this is not how you want to do it. The easiest solution here is to align the security team's understanding/expectations align with reality. You don't want to try to configure ProGet in unrealistic ways that will lead to actual problems/risks. I suspect the security team is conflating "vulnerable packages" with "malware and viruses", so it'd be best to take this opportunity to educate them on how packages / ProGet works. ProGet can prevent users from downloading certain packages, but vulnerable packages are freely available on the internet for download. A vulnerable package is NOT some a "virus in a lab that can escape" and infect a system A package is just a library and cannot run on its own If a user has a copy of vulnerable package, they can't use it to "hack" a system with it nor will it cause any harm Vulnerable packages simply shouldn't be used as building blocks in your own applications Thanks, Alana

@parthu-reddy yes, but we do recommend migrating... There are some known bugs/quirks with Maven (Classic) feeds and we will not fix them. We will likely not migrate them to PostgresSQL, which means you won't be able to migrate to PostgreSQL in ProGet 2025+. So it's likely that ProGet 2027 will not support them.

Hi @parthu-reddy, For a major upgrade, we recommend to schedule a maintenance window and then stop traffic from the load balancer. Then, upgrade the servers. For a maintenance release, it's fine to just upgrade them one at a time. It only take as few minutes to do that. There may be a few errors with the database/code being out of sync, but it likely will not cause any problems. -- Dean

@dean-houston Thanks

HI @parthu-reddy , Thanks for the feedback; I update the docs to mention that the feeds/permissiosn would also need to be updated as well. We hope to handle an in-place migration in a future version, but didn't want to delay shipping the feed. Please let us know if you have any issues/feedback. Note we are adding several improvements to the Maven (New) feeds in ProGet 2024.15: PG-2798 Add Direct Download (Artifact Import) Support for Maven (New) Feeds PG-2797 Add OSS Metadata Caching Support to Maven (New) Feeds PG-2796 Improve MavenIndex Download Visibility for New Feed Connectors PG-2792 Feed Management API Returns Empty Type on Maven2 and new feeds PG-2794 Add Simulated Directory Browsing to Maven (New) Feeds -- Dean

Hi @parthu-reddy , I'm afraid we don't have enough information to help with this; it appears to be an error the tool you're using (packet), and there's not enough information in the screenshot to see what error packet is encountering. It just says "Packaged failed with could not download..." We aren't familiar enough with packet to know how to follow their Stack Trace. If you can't find a clear error message, I would use an HTTP Proxy tool like Fiddler Classic to inspect the traffic that packet is making, and see if you can spot an issue there. I would also try downgrading packet , as it's very possible there's a regression in the tool. -- Dean

Hi @parthu-reddy, This is usually an indication of an outside process accessing this file. To verify this, if you restart ProGet, access to that file will be restored. If it is still locked, then something external to ProGet is accessing it. The most likely culprit is an antivirus scanning that file when ProGet attempts to access it. Can you restart ProGet and see if there is still a file-locking issue? If the file is still locked, can you verify that you do not have an antivirus solution that is constantly scanning that file and locking it? Thanks, Dan

Thanks, we're planning to upgrade tomorrow. Will keep you updated.

@atripp Ohh, sorry my mistake, changed it to proget, same problem actually. Will check at our end.

@atripp Thanks

In that case please just upgrade and it should be resolved :)