Great thanks for confirming Dean

Thanks Alex,

With the Enterprise version of the tool where it includes SCA capabilities it mentions that the PGVC is bundled as an offline database. What I'd be keen to understand is how often we'd need to update this DB or if the tool works in real-time fashion to keep vulnerabilites up-to-date?

Thanks

Stuart

Thanks @apxltd,

I'm assuming then the ideal scenario is effectively restart from scratch with a fresh Anaconda install and then configure ProGet to be connected to the Anaconda and PyPi repos with the new install pointed at ProGet for it's default channels so that any requests for new libraries or updates has to first be approved using the tool.

In terms of existing packages, anything that is still required we can then make use of the bulk file-system import.

Thanks

Stuart

Hi,

Looking for some advice around using ProGet as a SCA Tool for Data Scientists and Analysts using Python.

At present there is a very legacy setup for Python in my company which I'm looking to update or replace to make it easier for DS's and DA's to utilise Python. Our current set up is an internally hosted Python repo (it's a mirror of conda I believe from a few years ago) but it has not been looked after properly over the last few years with reorgs etc. and users have an older version of Anaconda available to them.

What I'm looking to do is update the whole development environment and I'm trying to decide on the best approach to take for this using ProGet as an SCA Tool to monitor the Python libraries being used within the business. The first option is keep our internal repo and sit ProGet in front of it to proxy any new libraries or updates to the repo and roll out a fresh install of Anaconda to users. The second option is do away with our internal repo and just use ProGet as a proxy/cache instead with the fresh install of Anaconda.

Ideally I'm trying to reduce the IT admin/overhead of having a Python development environment whilst making it easier for DS's and DA's to use Python whilst maintaining control from an IT Security perspective over what libraires we're allowing into our corporate network.

Any advice would be much appreciated.