Hi Guys,

Please could you allow your ProGet docker image to support secrets. Secrets are mounted as files from the docker host to the container. You should then allow a docker environment variable to specify a file path to the secret.

This could be used in a docker stack file in the following way:

version: '3.4'
services:
  Server:
    image: proget.inedo.com/productimages/inedo/proget:5.3.7
    networks:
      - traefik-public
      - clair
    environment:
      SQL_CONNECTION_STRING_FILE: "/run/secrets/proget_connection_string"
      TZ: "America/Denver"
    secrets:
     - source: proget_connection_string
       target: /run/secrets/proget_connection_string    
   volumes:
      - "/mnt/docker/proget/packages:/var/proget/packages"
      - "/mnt/docker/proget/extensions:/var/proget/extensions"
    deploy:
      mode: replicated
      replicas: 1
      placement:
        constraints:
          - node.platform.os == linux
  secrets:
  proget_connection_string:
    external: true
    name: proget_connection_string

You can find out more about docker secrets here:
https://docs.docker.com/engine/swarm/secrets/

Thanks
Simon

Hi @atripp

I like your "tags that use this layer" suggestion, I was also thinking you could do something like this mock-up within the repo view:

In addition you could also improve the "feed view" with some more information about the number of tags/images & vulnerablities per repo like this:

Or even:

Thanks @rhessinger

If that is the case then perhaps this view could have an extra column detailing the package this layer (and vulnerability) exists in?

The use case I have:

• I've just connected my docker registry feed to a Vulnerablity scanner source
• I have no way of finding out a "summary" of which packages/images in my feed have Vulnerabilities in them without clicking each repo and then clicking the "Vulnerabilities" tab
• Additionally if a developer uploads an image to the repo, that contains a new vulnerability how do I see this / get notified of this without checking each repo manually?

Thanks

Simon

Hi Guys,

Pretty sure this is a bug, I'm running ProGet v5.3.7 as a docker container.

Clicking on "Vulnerabilities" in the top navigation bar lists all discovered vulnerabilities. However in the package column it displays the package digest, not the name. It would be great if we could have the name instead.

Thanks

Simon

Hi @gdivis

I can confirm that TimeZone can now be specified as an environment variable in ProGet 5.3.7

Thanks for including this!

Simon

Hi @rhessinger

I can confirm that this fixes the issue! Thanks so much for all your help!

Simon

Hi @atripp

Perhaps you could also update the page on Docker Hub telling users that of the new location to download the proget image.

https://hub.docker.com/r/inedo/proget

Thanks

Simon

Hi @rhessinger

That's amazing Thanks. Let me know what version the fix will be in.

Thanks

Simon

Hi @rhessinger

Any update on this issue?

Thanks

Simon

Hi @atripp

It looks like you guys are using a Debian based container image. Therefore you would just need to add the following to your dockerfile to install tzdata on the image.

RUN DEBIAN_FRONTEND="noninteractive" apt-get -y install tzdata

Users (like myself) could then use something like the following to add a timezone environment variable to the docker run command:

docker run -d -v proget-packages:/var/proget/packages -p 80:80 --net=proget \
    --name=proget --restart=unless-stopped -e PROGET_DB_TYPE=SqlServer \
    -e SQL_CONNECTION_STRING='Data Source=proget-sql; Initial Catalog=ProGet; User ID=sa; Password=‹YourStrong!Passw0rd›' TZ='Europe/London' \
    proget.inedo.com/productimages/inedo/proget:<version>

Thanks

Simon

Hi All,

After posting this I managed to fix the issue by mapping the /etc/localtime file on the host to the container using a volume mount. Like this:

volumes:
      - "/etc/localtime:/etc/localtime"

However it would be nice if timezone could be specified using a "TZ:" environment variable.

However I do believe you would need to include the "tzdata" application in the ProGet container image to make that work. Would that be possible?

Thanks

Simon

Hi Support,

Wondering if there is a way to set the timezone of the ProGet container when running on docker?

I tried to use the following two environment variables in my docker swarm file but they don't seem to work:

  SET_CONTAINER_TIMEZONE: "true"
  CONTAINER_TIMEZONE: America/Vancouver

The docker container shows UTC as it's current timezone:

Thanks

Simon

Hi There,

I noticed there is a new "Package Usage" function in ProGet V5.3.5:

I'm using this on my Chocolatey feed, how is this usage information meant to be added? (the two rows in the screenshot above where added manually)

Is there an API for adding this usage information? I'm currently using the "Package deployment API" to record this same information but would be nice to record this info under "Package Usage" instead.

Thanks

Simon

Sure @rhessinger

Extensions:

Manage Feed:

Thanks

Simon

Hi @rhessinger

Removed and re-added but the same problem persists. Even updated to v5.3.5 and issue is the same.

Is there any other logging I can get for you? Any way I can see what calls are being made to Clair?

Thanks

Simon

Hi @rhessinger

Just Clair

Simon

Hi @rhessinger

Sorry I should have included that I do have the https:// specified.

Thanks

Simon

Hi @rhessinger

I have upgraded Proget to 5.3.4 (Build 4) but the problem still persists.

I am running Clair v2.1.2 and postgres v9.6 as suggested here: https://docs.inedo.com/docs/proget/compliance/clair

From the clair command line i can ping the public hostname of the ProGet instance:

For a bit of additional background Clair and the Postgres DB is running on it own separate overlay network, ProGet is a member of both this network and a public network. So for ProGet to communicate with Clair it can use a "service discovery" hostname of "ClairApp", Clair can then communicate with ProGet using either its service discovery name of "server" or using the public hostname that is specified in the "Web.BaseUrl" advance setting "proget.qa.xxxx.xxxx". This is what the above ping is communicating with.

Let me know what I can do next.

Thanks

Simon

Hi There,

I've installed the Clair extension into my ProGet 5.2.3 docker container and configured a Vulerablity Source as follows:

I can run the following command from the ProGet container commandline:

 curl http://clairapp:6060/v1/namespaces

And get the following result, so I know Clair is running correctly and that the ProGet container can communicate successfully with the Clair API endpoint.

{"Namespaces":[{"Name":"alpine:v3.7","VersionFormat":"dpkg"},{"Name":"alpine:v3.8","VersionFormat":"dpkg"},{"Name":"alpine:v3.10","VersionFormat":"dpkg"},{"Name":"alpine:v3.11","VersionFormat":"dpkg"},{"Name":"alpine:v3.3","VersionFormat":"dpkg"},{"Name":"alpine:v3.5","VersionFormat":"dpkg"},{"Name":"alpine:v3.6","VersionFormat":"dpkg"},{"Name":"alpine:v3.9","VersionFormat":"dpkg"},{"Name":"alpine:v3.4","VersionFormat":"dpkg"},{"Name":"amzn:2","VersionFormat":"rpm"},{"Name":"amzn:2018.03","VersionFormat":"rpm"},{"Name":"debian:unstable","VersionFormat":"dpkg"},{"Name":"debian:8","VersionFormat":"dpkg"},{"Name":"debian:9","VersionFormat":"dpkg"},{"Name":"debian:11","VersionFormat":"dpkg"},{"Name":"debian:10","VersionFormat":"dpkg"},{"Name":"ubuntu:12.10","VersionFormat":"dpkg"},{"Name":"ubuntu:16.04","VersionFormat":"dpkg"},{"Name":"ubuntu:15.10","VersionFormat":"dpkg"},{"Name":"ubuntu:19.04","VersionFormat":"dpkg"},{"Name":"ubuntu:17.10","VersionFormat":"dpkg"},{"Name":"ubuntu:18.04","VersionFormat":"dpkg"},{"Name":"ubuntu:14.04","VersionFormat":"dpkg"},{"Name":"ubuntu:17.04","VersionFormat":"dpkg"},{"Name":"ubuntu:16.10","VersionFormat":"dpkg"},{"Name":"ubuntu:12.04","VersionFormat":"dpkg"},{"Name":"ubuntu:14.10","VersionFormat":"dpkg"},{"Name":"ubuntu:15.04","VersionFormat":"dpkg"},{"Name":"ubuntu:18.10","VersionFormat":"dpkg"},{"Name":"ubuntu:13.04","VersionFormat":"dpkg"},{"Name":"oracle:6","VersionFormat":"rpm"},{"Name":"oracle:7","VersionFormat":"rpm"},{"Name":"oracle:5","VersionFormat":"rpm"},{"Name":"oracle:8","VersionFormat":"rpm"}]}

However when I run the VulnerabilityDownloader Scheduled Task manually by pressing this:

I get the following error:

ERROR: 2020-06-18 19:25:52Z - Unhandled exception: System.InvalidCastException: Specified cast is not valid.
  at Inedo.ProGet.ScheduledTasks.General.VulnerabilityDownloaderScheduledTask.ExecuteAsync (Inedo.ProGet.ScheduledTasks.ScheduledTaskContext context) [0x00133] in <5c992ee154394e758c7258b17e1dbffb>:0 
  at Inedo.ProGet.Service.Executions.ActiveScheduledTaskExecution.ExecuteAsync () [0x00182] in <a7f73bf1cfd3422e88d7232a4ec2eaf3>:0 

Ultimately I don't believe the ProGet to Clair connection is really working, is there any way I can verify this?

One of the main reasons I believe this is because when I issue the CURL Command above I get a Clair log that reads:

{"Event":"Handled HTTP request","Level":"info","Location":"router.go:57","Time":"2020-06-18 19:35:53.616609","elapsed time":1216718,"method":"GET","remote addr":"10.0.5.4:42524","request uri":"/v1/namespaces","status":"200"}

However I don't get any such logs from ProGet attempting to use the Clair API.

Thanks in advance

Simon

Hi,

I'm running ProGet as a container on my docker swarm using a Stack File. I have it all setup and running but would like to include the use of a docker HEALTHCHECK to ensure the application is running as normal.

I'd like to use the /health API endpoint included with ProGet and documented here: https://docs.inedo.com/docs/proget/reference/api/health to query the

"serviceStatus": "OK"

attribute.

Does anyone have any experience doing this? I'd love to do a Curl request and pipe the output of that into "jq" but it doesn't appear that "jq" is installed on the docker image. Do you know if there are any plans to change that?

Alternatively is there any way to pass query parameters to the /health endpoint? For example:

/health?serviceStatus

And it just return "OK"

I'm running ProGet V5.2.30

Thanks

Simon