Ensure Local Packages Match MyGet Packages

[MalwareMechanic]

We should have a GitHub Action that compares packages in the GitHub repository to those hosted on MyGet and let us know if they differ. For example, we if remove a local package or rename one, this action should point out a conflict so we can take the appropriate actions to remedy it.

[mr-tz]

Can you describe how to do this on a high level? I could try to get started on it.

[MalwareMechanic]

Sure! We'd need a GitHub Action to:

• Gather a list of packages from the packages directory (preferably parsing nuspec info to get name and version)
• Get a remote list of packages from MyGet
  • E.g., choco list -s "https://www.myget.org/F/vm-packages/api/v2" -r
• Compare for conflicts (version mismatch (e.g,. less than, greater than, etc...), renames, missing, etc...)

The command below shows the latest version of each package in our current MyGet repo.

PS C:\Users\IEUser\Desktop> choco list -s "https://www.myget.org/F/vm-packages/api/v2" -r
010editor.vm|12.0.1
7zip.vm|15.05
apimonitor.vm|2.13.0.20220224
apktool.vm|2.7.0
asreproast.vm|0.0.0.20180925
bloodhound.vm|4.2.0
capa.vm|4.0.1
cmder.vm|0.0.0.20210603
common.vm|0.0.0.20221201
cyberchef.vm|9.49.0
cygwin.vm|3.2.0.20221201
die.vm|3.02.20220113
dnspyex.vm|6.2.0
explorersuite.vm|0.0.0.20221115
fakenet-ng.vm|1.4.11.20221115
flarevm.installer.vm|0.0.0.20221201
floss.vm|2.1.0
ghidra.vm|10.1.2
gobuster.vm|3.0.1.20220113
hashmyfiles.vm|0.0.0.20220113
idafree.vm|7.6
libraries.python2.vm|0.0.0.20221128
libraries.python3.vm|0.0.0.20221128
map.vm|0.24
notepadplusplus.vm|8.4.7.20221129
notepadpp.plugin.compare.vm|2.0.1.20211225
ollydbg.ollydumpex.vm|1.80
ollydbg.vm|1.10.0.20220908
ollydbg2.ollydumpex.vm|1.80
ollydbg2.vm|2.01
peid.vm|0.95.0.20221115
processdump.vm|2.1.1.20220908
regshot.vm|1.9.1
rundotnetdll.vm|2.2
sysinternals.vm|0.0.0.20211030
uniextract2.vm|2.0.0.20220113
vcbuildtools.vm|0.0.0.20221120
wireshark.vm|3.6.0
x64dbg.ollydumpex.vm|1.80
x64dbg.vm|2021.05.08
x64dbgpy.vm|1.0.56.20211021

To get ALL the versions on MyGet run the below:

PS C:\Users\IEUser\Desktop> choco list -s "https://www.myget.org/F/vm-packages/api/v2" -r -a
010editor.vm|12.0.1
7zip.vm|15.05
apimonitor.vm|2.13.0.20220224
apktool.vm|2.7.0
apktool.vm|2.6.1
asreproast.vm|0.0.0.20180925
bloodhound.vm|4.2.0
capa.vm|4.0.1
cmder.vm|0.0.0.20210603
common.vm|0.0.0.20221201
common.vm|0.0.0.20221128
cyberchef.vm|9.49.0
cygwin.vm|3.2.0.20221201
cygwin.vm|3.2.0
die.vm|3.02.20220113
dnspyex.vm|6.2.0
explorersuite.vm|0.0.0.20221115
fakenet-ng.vm|1.4.11.20221115
flarevm.installer.vm|0.0.0.20221201
flarevm.installer.vm|0.0.0.20221129
floss.vm|2.1.0
ghidra.vm|10.1.2
gobuster.vm|3.0.1.20220113
hashmyfiles.vm|0.0.0.20220113
idafree.vm|7.6
libraries.python2.vm|0.0.0.20221128
libraries.python3.vm|0.0.0.20221128
map.vm|0.24
notepadplusplus.vm|8.4.7.20221129
notepadpp.plugin.compare.vm|2.0.1.20211225
ollydbg.ollydumpex.vm|1.80
ollydbg.vm|1.10.0.20220908
ollydbg2.ollydumpex.vm|1.80
ollydbg2.vm|2.01
peid.vm|0.95.0.20221115
processdump.vm|2.1.1.20220908
regshot.vm|1.9.1
rundotnetdll.vm|2.2
sysinternals.vm|0.0.0.20211030
uniextract2.vm|2.0.0.20220113
vcbuildtools.vm|0.0.0.20221120
wireshark.vm|3.6.0
x64dbg.ollydumpex.vm|1.80
x64dbg.vm|2021.05.08
x64dbgpy.vm|1.0.56.20211021

In PS we could parse like:

        (Get-Content $packageList) | ForEach-Object {
            $Name, $Version = $_ -split '\|'
            New-Object -TypeName psobject -Property @{
                'Name' = $Name
                'Version' = $Version
            }
        }