running MSDO behind the proxy #61

Activity

1. davidknise commented on Jun 21, 2023

   

   David Knise (davidknise)

   on Jun 21, 2023

   Member

   More actions

   Hi osilberman, can you provide more details?
2. davidknise commented on Jun 22, 2023

   

   David Knise (davidknise)

   on Jun 22, 2023

   Member

   More actions

   I looked into this and realized eslint fails on my devbox due to a global Microsoft (@microsoft) registry defined.

   I've filed an item for the team to look into.
3. osilberman commented on Jun 23, 2023

   

   osilberman

   on Jun 23, 2023

   Author

   More actions

   Hi David Knise (@davidknise) thank you for your response. The reason of my question is this one (also filed here microsoft/security-devops-azdevops#56)

   I receive below error running the task on windows self-hosted agent. The error appeared starting 16th of June:

   Installing Microsoft Security DevOps Cli version: Latest
   ##[debug]packageName = Microsoft.Security.Devops.Cli.win-x64
   ##[debug]agentDirectory = C:\agt_work_msdo
   ##[debug]agentPackagesDirectory = C:\agt_work_msdo\packages
   ##[debug]agentVersionsDirectory = C:\agt_work_msdo\versions
   ##[debug]MSDO CLI version contains a latest quantifier: Latest. Continuing with install...
   ##[debug]MSDO_MICROSOFTSECURITYDEVOPSCLIWINX64_LATESTVERSION=undefined
   ##[debug]Fetching service index for: https://api.nuget.org/v3/index.json
   ##[debug]GET https://api.nuget.org/v3/index.json
   ##[debug]Error: Error calling url: Error: connect ECONNREFUSED 13.107.246.67:443
   ##[debug]MSDO_MICROSOFTSECURITYDEVOPSCLIWINX64_LATESTVERSION=undefined
   ##[debug]Fetching service index for: https://api.nuget.org/v3/index.json
   ##[debug]GET https://api.nuget.org/v3/index.json
   ##[debug]Error: Error calling url: Error: connect ECONNREFUSED 13.107.246.67:443
   ##[debug]MSDO_MICROSOFTSECURITYDEVOPSCLIWINX64_LATESTVERSION=undefined
   ##[debug]Fetching service index for: https://api.nuget.org/v3/index.json
   ##[debug]GET https://api.nuget.org/v3/index.json
   ##[debug]Error: Error calling url: Error: connect ECONNREFUSED 13.107.246.67:443
   Exception occurred while initializing MSDO:
   ##[debug]task result: Failed
   ##[error]Error: Failed to install the MSDO CLI nuget package.
   ##[debug]Processed: ##vso[task.issue type=error;]Error: Failed to install the MSDO CLI nuget package.
   ##[debug]Processed: ##vso[task.complete result=Failed;]Error: Failed to install the MSDO CLI nuget package.

   Does it have to do with your update? The agent version is the latest 2.218.1

   Thank you!!

   👍React with 👍1Reacted by David Knise
4. exigopro commented on Jul 28, 2023

   

   exigopro

   on Jul 28, 2023

   More actions

   Facing the same issue. I believe permitting access to api.nuget.org from your self-hosted agent might work. Will perform some testing.
5. osilberman commented on Aug 25, 2023

   

   osilberman

   on Aug 25, 2023

   Author

   More actions

   were you successful with your testing?
6. CapG-SLeeke commented on Jan 5, 2024

   

   CapG-SLeeke (CapG-SLeeke)

   on Jan 5, 2024

   More actions

   Hi,

   I had the same issue and originally raised as incident here : Error: Failed to install the MSDO CLI nuget package while running behind proxy #59

   I have tracked the issue down to a specific JS script : msdo-nuget-client.js

   The ultimate issue is the msdo nuget client just doesnt handle a proxy.

   is complete msdo has the tunnel library included so it is simple to update.

   Add the below on line 37 :

   const tunnel = __importStar(require("tunnel"));

   the replace the function called resolveRequestOptions ( rough line 348 )

   function resolveRequestOptions(accessToken) {
        // Add Proxy Support https over http
       let options = {
           method: 'GET',
           timeout: 2500,
           headers: {
               'Content-Type': 'application/json'
           }
   	};			
       var tunnelineAgent = false;
   	console.log(`## Info :: resolveRequestOptions :: Checking Proxy Env for Request Options`);
   	if (process.env.http_proxy) {
   		console.log(`## Info :: resolveRequestOptions :: Adding Proxy for Request Options`);
   		try {
   			const proxyurl = new URL(process.env.http_proxy);
   	        tunnelineAgent = tunnel.httpsOverHttp({
                               proxy: {
                               host: proxyurl.hostname ,
                               port: proxyurl.port 
                               }
                           });
   				options['agent'] = tunnelineAgent ;     
           } catch (error) {
   	        console.log(`## warning proxy env variable malformed :: example http://proxyserver:8080 :: ${error}`);
   		}
   	} else {
   		console.log(`## Info :: resolveRequestOptions :: No Proxy Env Request Options`);
       }
       if (!common.isNullOrWhiteSpace(accessToken)) {
   	console.log(`## Info :: An accessToken is being used`);
           options['auth'] = `:${accessToken}`;
       } else {
   	    console.log(`## Info :: No accessToken is being used`);
       }
       return options;
   }
   

   This then works a treat when having a proxy or not. This only really handles https over a http proxy though.

   	        tunnelineAgent = tunnel.httpsOverHttp({
                               proxy: {
                               host: proxyurl.hostname ,
                               port: proxyurl.port 
                               }
                           });
   

   it should really handle https over https it would be something like, but you need to use proxyurl.protocol == 'https:' to decide

   
   	        tunnelineAgent = tunnel.httpsOverHttps({
                               proxy: {
                               host: proxyurl.hostname ,
                               port: proxyurl.port 
                               }
                           });
   
7. richardtucker

   pinned this issue on Jan 14, 2025
8. DimaBir commented on Jul 28, 2026

   

   Dima Birenbaum (DimaBir)

   on Jul 28, 2026

   Collaborator

   More actions

   A fix for this is up in #272.

   resolveRequestOptions in the vendored msdo-nuget-client.js returned request options with no agent, and both https.request call sites — the NuGet service-index lookup and the .nupkg download — inherited that. Node's https module does not read proxy environment variables on its own, so the CLI install reached the network directly regardless of HTTPS_PROXY being set, which is why it hung or failed behind an egress proxy.

   The change adds a resolveProxyAgent(url) that reuses @actions/http-client's proxy resolution — so HTTPS_PROXY, https_proxy and NO_PROXY are all honored, including proxies with credentials — and assigns the resulting tunnel agent at both call sites. When no proxy is configured the agent stays unset and requests take exactly the path they take today.

   Two things worth stating plainly:

   • This lands in node_modules/@microsoft/security-devops-actions-toolkit/, which is committed in this repo, so it takes effect at runtime. It will be lost on the next toolkit bump, so the same fix needs to land upstream in microsoft/security-devops-actions-toolkit to be durable. That is being routed there.
   • The upstream fix also covers the equivalent Azure DevOps extension reports, which share this download path.
9. Dima Birenbaum (DimaBir)

   closed this as completedin #272on Jul 29, 2026
10. Dima Birenbaum (DimaBir)

    added

    type:bugSomething isn't workingSomething isn't working

    area:actionGitHub Action definition, inputs, and outputsGitHub Action definition, inputs, and outputs

    on Jul 29, 2026