404 error when installing extension

[carlosjourdan]

Hello.

I'm trying to setup a small proof of concept using code-marketplace to distribute extensions on a corporate environment.

On a windows box, I was able to get the code-marketplace server up and running behin an nginx proxy for ssl termination, and by editing the product.json file in the vs code install dir I'm able to list the custom extensions on the extensions tab.

However, when I click on install, I get a XHR error and a message to try to download the extension manually. When I choose that option, my browser opens up to a 404 page on an address that looks like this https://mydomain.com/api/publishers/undefined/vsextensions/test-extension/0.0.1/vspackage.

Has anyone run into this sort of issue?

Best regards,
Carlos Jourdan

[code-asher]

That undefined is strange. I am not sure how the publisher could be undefined unless it was missing from the manifest.

There should be something like this in the manifest:

<Identity Language="en-US" Id="coder-remote" Version="0.1.24" Publisher="coder" />

Where are you getting the extensions? I could take a look at one and see if I get the same issue.

[carlosjourdan]

The extension is just an empty test created using yo code.

I don't think the "undefined" is a problem, but rather the URL formation.

I can donwload the package file under https://mydomain.com/files/undefined/test-extension/0.0.1/full-package-name.vsix

I made the following modifications on the product.json file, based on the parameters on the docs for vsx integration.

"extensionsGallery": {
  "serviceUrl": "https://mydomain.com/api",
  "itemUrl": "https://mydomain.com/item",
  "resourceUrlTemplate": "https://mydomain.com/{publisher}/{name}/{version}/{path}"
}

Should I add something for "nlsBaseUrl", "publisherUrl" or "controlUrl"?

[code-asher]

I see, so it is just using the literal string undefined as the publisher name.

No, nlsBaseUrl, publisherUrl, and controlUrl should not be required.

Let me try yo code with the latest marketplace and code-server and see if I get similar issues. Will report back soon.

[code-asher]

I experimented and it is working for me with code-server, at least. Here is every step I did. First, to make the extension:

$ npx --package yo --package generator-code -- yo code # accept all the defaults, name it test
$ cd test
$ echo test > README.md # vsce will not package if default readme is used
$ sed -i 's/1.87.0/1.86.0/' package.json # latest code-server wraps 1.86.0
$ touch LICENSE # so vsce does not complain
$ npx @vscode/vsce package --allow-missing-repository

Next, to set up the marketplace:

$ wget https://github.com/coder/code-marketplace/releases/download/v2.1.0/code-marketplace-linux-amd64
$ chmod +x code-marketplace-linux-amd64
$ ./code-marketplace-linux-amd64 --extensions-dir ./extensions add ./test/test-0.0.1.vsix 
$ ./code-marketplace-linux-amd64 --extensions-dir ./extensions server

Then install and run code-server:

$ curl -L https://code-server.dev/install.sh | sh -s -- --method=standalone
$ export EXTENSIONS_GALLERY='{"serviceUrl":"http://localhost:3001/api", "itemUrl":"http://localhost:3001/item", "resourceUrlTemplate": "http://localhost:3001/{publisher}/{name}/{path}"}' # should be the same as editing product.json
$ ~/.local/bin/code-server --auth none

Lastly:

1. Browse to localhost:8080
2. Open extensions from sidebar
3. Click install on the test extension listed under Popular
4. Success!

I have not tried it with native VS Code, only code-server, so maybe there is something different there...are you just running the latest VS Code? 1.86.0? Or I guess maybe 1.87.0 since that came out yesterday I think. My product.json is read-only and I cannot run it standalone so I need to figure out a different way to test it.

[code-asher]

A thought: run Developer: Toggle Developer Tools, then try to install the extension again and see if any errors show up in the console or the network tab. Currently I get an XHR error before I can even list extensions but it is because the content security policy only allows https and I am using http://localhost, so I guess I need to set up a self-signed certificate to test with native VS Code.

[code-asher]

All right, I put my marketplace behind a certificate and trusted it on the system running VS Code, and I was able to install successfully (I edited the package.json just like yours). Definitely check out the developer tools in VS Code and see if it tells you anything.

[veveno]

Hello i have probably the same probleme. I'm in airgapped env. Im running code-server in k8s. I have setup CORS. And using SSLTerminate behind HAPROXY.
I can put extension on code-server. i can list extension with VSCODE but when i'm trying to install extension i'm getting XHR Error.

The Developer: Toggle Developer Tools return me the request URL : http://assets/hashicorp/terraform/2.31.0@linux-x64/Microsoft.VisualStudio.Services.Icons.Default?targetPlatform=linux-x64

But the URL return is in HTTP, and VScode policy dont want it. I'm trying to force ingress to use HTTPS but no one works

It's possible to switch on code server to request with HTTPS URL ?

[code-asher]

Just to confirm, did you set the required forwarding headers? See the section here: https://github.com/coder/code-marketplace?tab=readme-ov-file#exposing-the-marketplace

[veveno]

Just to confirm, did you set the required forwarding headers? See the section here: https://github.com/coder/code-marketplace?tab=readme-ov-file#exposing-the-marketplace

Yee I have tried in front of my haproxy and my nginx ingress, but it's possible I do it bad.

I will try tomorrow.

Thanks for answer

[veveno]

Hello, yes i have correctly setup the Forwarded-host & Forwarded-Proto, but i've got the same probleme, in my ingress nginx i set this parameter :

annotations:
    nginx.ingress.kubernetes.io/enable-cors: "false"
    nginx.ingress.kubernetes.io/cors-allow-origin: "*"
    nginx.ingress.kubernetes.io/configuration-snippet: |
          proxy_set_header X-Forwarded-Host $host;
          proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;

And when i'm trying to download some externsion VSCode said me:

Refused to load the image 'http://<domain.com>/assets/hashicorp/terraform/2.31.0@linux-x64/Microsoft.VisualStudio.Services.Icons.Default?targetPlatform=linux-x64' because it violates the following Content Security Policy directive: "img-src 'self'
					data:
					blob:
					vscode-remote-resource:
					vscode-managed-remote-resource:
					https:".

But my request URL is in https :

Request URL:  https://<domain.com>/api/extensionquery
Request Method:  POST
Status Code:  200 OK
Remote Address: local.adress:443
Referrer Policy:  strict-origin-when-cross-origin

[code-asher]

Interesting...we get the protocol here:

code-marketplace/api/httpapi/httpapi.go

Lines 56 to 72 in f44f339

	forwarded := strings.Split(r.Header.Get(ForwardedHeader), ";")
	for _, val := range forwarded {
	parts := strings.SplitN(val, "=", 2)
	switch strings.TrimSpace(parts[0]) {
	case "host":
	host = strings.TrimSpace(parts[1])
	case "proto":
	proto = strings.TrimSpace(parts[1])
	}
	}
	if proto == "" {
	proto = r.Header.Get(XForwardedProtoHeader)
	}
	if proto == "" {
	proto = "http"
	}

So, assuming Forwarded is not set it should be using the value of X-Forwarded-Proto.

Is $http_x_forwarded_proto not the right value maybe? I have seen $scheme used elsewhere. Or maybe try hardcoding it to https for now just to validate whether it works.

[veveno]

Bonjour,

I've tried so many option but no on works. I actually i have set :

      nginx.ingress.kubernetes.io/configuration-snippet: |
            more_set_headers "X-Forwarded-Host $http_host";
            more_set_headers "X-Forwarded-Proto https";

And the only solution working is to hardcoding http to https. And now it's work perfectly.

I don't why but my ingress or haproxy add header to force http of the answer :(

Merci :)

[code-asher]

Interesting! I wonder if there is something weird with $http_x_forwarded_proto. I am glad hardcoding it works though.