Check-PSGalleryApiAvailability prevents working with PSGallery

[OCram85]

Steps to reproduce

Import-Module PowerShellGet
Find-Module -Name 'VMware.PowerCLI' -Repository PSGallery -Verbose -Proxy 'http://a.b.c.d:3128'

Expected behavior

• Returning the found module, or installing the module while using Install-Module

Actual behavior

Get-PSGalleryApiAvailability : PowerShell Gallery is currently unavailable.  Please try again later.
At C:\tools\powershell-6.1.0-win-x64\Modules\PowerShellGet\PSModule.psm1:8761 char:9
+         Get-PSGalleryApiAvailability -Repository $Repository
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : InvalidOperation: (:) [Get-PSGalleryApiAvailability], InvalidOperationException
+ FullyQualifiedErrorId : PowerShellGalleryUnavailable,Get-PSGalleryApiAvailability

Get-PSGalleryApiAvailability : PowerShell Gallery is currently unavailable.  Please try again later.
At C:\tools\powershell-6.1.0-win-x64\Modules\PowerShellGet\PSModule.psm1:9307 char:9
+         Get-PSGalleryApiAvailability -Repository $Name
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : InvalidOperation: (:) [Get-PSGalleryApiAvailability], InvalidOperationException
+ FullyQualifiedErrorId : PowerShellGalleryUnavailable,Get-PSGalleryApiAvailability

Any action with the PSGallery or other NuGet repositories fails cause of the internal function Check-PSGalleryApiAvailability.

In environments where the Test-Connection fails due to other in house security policies interpreting it as an connection issue seems to be wrong.

Is there any way to bypass these checks?

Environment data

• Win7 Client
• Any traffic goes through proxy
• No Ping or ICMP forwarding

Tested with PowerShell 5.1 and 6

• PowerShell 5.1

Name                           Value
----                           -----
PSVersion                      5.1.14409.1012
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.14409.1012
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

• PowerShell 6

Name                           Value
----                           -----
PSVersion                      6.1.0
PSEdition                      Core
GitCommitId                    6.1.0
OS                             Microsoft Windows 6.1.7601 S
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

> Get-Module -ListAvailable PowerShellGet,PackageManagement

ModuleType Version    Name                                PSEdition ExportedCommands
---------- -------    ----                                --------- ----------------
Script     1.1.7.2    PackageManagement                   Desk      {Find-Package, Get-Package, Get-PackageProvider, Get-PackageSource...}
Script     2.0.3      PowerShellGet                       Desk      {Find-Command, Find-DSCResource, Find-Module, Find-RoleCapability...}

> Get-PackageProvider -ListAvailable

Name                     Version          DynamicOptions
----                     -------          --------------
NuGet                    2.8.5.210        Destination, ExcludeVersion, Scope, SkipDependencies, Headers, FilterOnTag, Contains, AllowPrereleaseVersions, ConfigFil...
PowerShellGet            1.6.7.0          PackageManagementProvider, Type, Scope, AllowClobber, SkipPublisherCheck, InstallUpdate, NoPathUpdate, AllowPrereleaseVe...

Editing Notes

• fixed the installed PowerShellGet version -> 2.0.3

[SydneyhSmith]

This seems related to #270
It seems like error message could be better in indicating why the module was not found.

You mentioned that in house security is causing the Test-Connection to fail, is this because it is trying to ping 'www.microsoft.com'? Would you want an option to skip PSGalleryApiAvailability checks all together?

[OCram85]

Yes all the clients can't ping external hosts. So for me a warning if the tests fails would be great. But the failed test shouldn't stop the commands like Update-Module, Find-Module or Install-Module.
So either a warning for failed connection tests or a switch to bypass them would be awesome!

Unfortunately I'm not familiar with the code structure and build process here. So I can't create a useful PullRequest quickly :(

[iricigor]

Hi @OCram85

Just for better understanding, can you also run these three commands on the same machine where Find-Module fails and submit results?

Test-Connection -ComputerName 'www.microsoft.com'  -Quiet
Test-NetConnection -ComputerName 'www.microsoft.com'  -InformationLevel Quiet
[System.Net.NetworkInformation.NetworkInterface]::GetIsNetworkAvailable()

[OCram85]

Here are the test results:

Well, internal Clients can't access external hosts without the proxy. But you can't ping through a proxy. So this will fail on every client without direct access or firewall policies denying ICMP requests.:

[iricigor]

As soon as at least one of the tests is True, it should work. I see the issue, I will do a PR for a hotfix.

However, your question and also a question asked in #270 remains:

What does the ability to ping www.microsoft.com have to do with checking a URL's API.

@SydneyhSmith: I was not able to catch dependencies from Get-PSGalleryApiAvailability. It is called at multiple places in the code, inside of it it only calls Check-PSGalleryApiAvailability and it either throws an errors or does nothing. Can it be clarified if this check can be removed or simiplified? Removing can be done either completly, or bypassing (via switch?) as @OCram85 suggested.

[OCram85]

I also notices a different behavior for Install-Module, Find-Module and Update Module.

• Install-Module, Find-Module fails if Check-PSGalleryApiAvailability
• Update-Module works because it doesn't use Check-PSGalleryApiAvailability
  • That's why i didn't notice the issue earlier ^^

[edyoung]

The intent of Get-PSGalleryApiAvailability is a bit mysterious because it is supposed to distinguish between 3 cases.

1. The gallery is not reachable at all
2. The gallery is reachable and has a working /api/v3 endpoint
3. The gallery is reachable and has a working /api/v2 endpoint

And use this to inform users to switch to the v3 endpoint.
However the gallery doesn't support nuget v3 yet (no ETA on that, sorry) so it serves no useful purose.

I am in favor of removing this functionality altogether. When we get to implementing a v3 endpoint we will need to re-evaluate this code anyway. Happy to consider a PR for this.

[OCram85]

@edyoung: I could help creating a PR which contains:

• remove Get-PSGalleryApiAvailability references and the function itself
• remove Check-PSGalleryApiAvailability references and the function itself
• remove unused variables:

$Script:PSGalleryV2ApiAvailable = $true
$Script:PSGalleryV3ApiAvailable = $false
$Script:PSGalleryApiChecked = $false

Should it target anything else?