[BUG] [ws-nexus-integration] Errors while scanning Nuget and RAW repositories

[T0hha]

I was trying to scan Nuget and RAW repositories but got some errors. I was running these scans in OpenShift container and here is the content of params.config file:

[Nexus Settings] NexusBaseUrl=http://nexus:8081 NexusAuthToken= NexusUser=admin NexusPassword=password NexusRepositories=nuget,nuget-goblin,nuget-gallery NexusExcludedRepositories= NexusAltDockerRegistryAddress=

[WhiteSource Settings] WSUserKey=5f113b WSApiKey=e9afc7 WSProductName=Nuget WSCheckPolicies=False WSUrl=https://saas-eu.whitesourcesoftware.com WSLang=

[General Settings] ThreadCount=3 WorkDir= JavaBin=

I've attached my log files with errors.

Nexus_raw.txt Nexus_nuget.txt

Hope for your help. Best regards, Anton Krivonosov

[rammatzkvosky]

Hi @T0hha ,

Sorry for the late reply, I'm checking this issue and will get back to you with my findings by the beginning of next week.

Thanks, Ram

[rammatzkvosky]

Hi @T0hha , It looks like you ran version 0.2.13 Please try to run with our latest version ( 0.3 ).

If you are still facing the same issue - please share the logs from that run.

Thanks,

Ram

[T0hha]

Hi @rammatzkvosky ,

You were right about the version. I've updated our container and use the latest source code but unfortunately it didn't help :( I got errors again for both Nuget and Raw repos. Logs are attached as well.

Best regards, Anton

Raw_logs_03.txt Nuget_logs_03.txt

[rammatzkvosky]

Hi @T0hha ,

Thank you for the logs -> I'm checking it and will get back to you soon.

Best regards, Ram

[rammatzkvosky]

Hi @T0hha ,

Sorry for my late reply.

For the nuget issue, could you please run the following and share your output ( we run the same with python’s requests )?

curl -X GET \
  ‘http://denotsl214.int.kn:8081/repository/nuget/libsodium_vc120/1.0.12’ \
  --header ‘Accept: application/json’ \
  --header ‘Authorization: Basic [token]’

Also, please check in the repository configuration that there is no blocking for connections/requests.

---

For the RAW repos, I found a BUG which was fixed.

You can try the latest version ( please notice there was some change in the params.config following a rebranding of Whitesource --> Mend , so you will need to use the latest one ).

Thanks,

Mend's PS team

[T0hha]

Hi @rammatzkvosky ,

I've installed the latest version of Nexus script and did my scans. The initial problem with "raw" repos is gone. Thanks for the fix. I was able to scan most of our repos. Unfortunately there seem to be another issue. I've attached two log files with the same problem. Please have a look.

Regarding the Nuget repos, when I open this repo in the browser I see only one package VmwareApi:1.0.0 I've tried to request the missing package with Curl and in the browser and of course I get error 404

Hope this will be useful for you. Thanks in advance.

Hi @T0hha ,

Sorry for my late reply.

For the nuget issue, could you please run the following and share your output ( we run the same with python’s requests )?

curl -X GET \
  ‘http://denotsl214.int.kn:8081/repository/nuget/libsodium_vc120/1.0.12’ \
  --header ‘Accept: application/json’ \
  --header ‘Authorization: Basic [token]’
[Nexus[raw]_logs2.txt](https://github.com/whitesource-ps/ws-nexus-integration/files/9754651/Nexus.raw._logs2.txt)

Nexus[raw]_logs.txt

Also, please check in the repository configuration that there is no blocking for connections/requests.

For the RAW repos, I found a BUG which was [fixed](https://github.com/whitesource-ps/ws-nexus-integration/pull/54).

You can try the [latest version](https://pypi.org/project/ws-nexus-integration/22.10.1/) ( please notice there was some [change in the params.config](https://github.com/whitesource-ps/ws-nexus-integration/pull/54/files#diff-e5d606af935f249482a42ff6734382abbcb6213a336ce6714d4b8ea7d503885e) following a rebranding of Whitesource --> Mend , so you will need to use the [latest one](https://github.com/whitesource-ps/ws-nexus-integration/blob/master/config/params.config) ).

Thanks,

Mend's PS team

[T0hha]

Hi @rammatzkvosky,

do you have any updates regarding to my last comment?

[rammatzkvosky]

Hi @T0hha We are examining it this week. I will update you in advance with our findings.

[rammatzkvosky]

Hi @T0hha ,

For the VmwareApi:1.0.0 package - if you can't get it with curl, it means that something is disabling retrieving it. How do your users retrieve this package regularly?

For both logs, I saw in the log files you shared that a '.' dot file / name-inode maps--> how was it uploaded to nexus?

[ramibo]

Hi @T0hha ,

Do you have an update regarding my last comment?