Is it possible to publish packs to private registries ?

[hugo-syn]

Hello, I was wondering if it is possible to publish packs to private registries ?

Thank you.

[redsun82]

Yes! Please refer to https://docs.github.com/en/code-security/how-tos/find-and-fix-code-vulnerabilities/scan-from-the-command-line/publish-and-use-packs for more details. You'll have to have a corresponding qlconfig.yml file, more details about that at https://docs.github.com/en/code-security/codeql-cli/using-the-codeql-cli/publishing-and-using-codeql-packs#using-a-custom-codeql-package-registry

[mbg]

Putting a token for the registry in the config file should be the right approach, but I think the URLs have to be an exact match for it to get picked up. So you would need to use http://127.0.0.1:5000/v2/ instead of just http://127.0.0.1:5000/.

[hugo-syn]

@mbg I tried both, and it's still not working, still doing a query to the token endpoint

[mbg]

Sorry, I just had a look over the implementation and it looks like the credentials can't actually be configured in the config files themselves. Try setting the CODEQL_REGISTRIES_AUTH environment variable to "http://127.0.0.1:5000/v2/=<token>". It accepts a comma-separated list of <registry_url>=<token> pairs.

[hugo-syn]

Ok better now, but I still have some issues after, I leave it opened, I'll do more testing

[hugo-syn]

Hey @mbg actually CODEQL_REGISTRIES_AUTH is not working only the --registries-auth-stdin option:

$ export CODEQL_REGISTRIES_AUTH=https://custom.local/v2/=TOKEN1
$ codeql pack download codeql/csharp-queries -v
Package specifications to check for download: codeql/csharp-queries
Recording pack reference codeql/csharp-queries at /home/user/.codeql/packages/codeql/csharp-queries/1.7.5.
Packaging> Requesting package versions of codeql/csharp-queries from https://ghcr.io/v2/codeql/csharp-queries/tags/list?n=100
...