Tk-config-basic update breaks Desktop behind proxy

Pipeline Integrations
, ,
1

Hi all, once again we are unable to launch Shotgun Desktop behind a proxy after an update to tk-config-basic (I think).

We are getting 403 Forbidden from downloading updates from the AppStore.

@jfboismenu @mathurf perhaps any ideas?

edit: attached log
tk-desktop-behind-proxy.log (7.2 KB)

2 Likes
2

Copying the new version of tk-basic-config manually into bundle_cache fixed it, at least for now.

We would like to form some kind of standard response for such occasions - what would you recommend?

2 Likes
3

Hi @mmoshev,

We’re sorry you’re having issues with downloads from the AppStore. We’ve made some backend changes recently and the way in which your firewall, gateway or proxy is configured may have impacted your downloads.

First, if this change is preventing you from working, you can completely disable AppStore access by setting the SHOTGUN_DISABLE_APPSTORE_ACCESS environment variable to 1 on your computer. This will allow Shotgun Desktop and Shotgun Create to operate normally.

Here are a few reasons why you may not be able to download media at the moment:

  1. If your studio is filtering which sites can be accessed based on IPs, make sure the entire range of IPs required to download from the Tank AppStore is allowed.
  2. If you are filtering which sites can be accessed based on URLs (for example tank.shotgunstudio.com), you need to add s3-proxy.shotgunstudio.com.

We always recommend that you filter access based on an IP list, as this will protect you against any URL change in our backend. Let us know if that helps unblock you, or if there’s anything further we can do to help.

-David

2 Likes
4

Thank you, this is helpful. I’m going to see what filtering we have in place.
Otherwise I’m going to set SHOTGUN_DISABLE_APPSTORE_ACCESS to let artists work in the meanwhile.

2 Likes
5

We were hit with this too and have locked down our site level config so we don’t get updates (which we were meaning to do anyway).

I think we’ll probably look into downloading all the apps to a local location and disabling the app store with SHOTGUN_DISABLE_APPSTORE_ACCESS

Jared

4 Likes
6

Thank you, we have also been considering taking over the site config. It is probably a good idea.

1 Like
7

Hi all –

We’ve gone ahead and rolled back the v1.3.10 release of tk-config-basic, and are back on v1.3.9. Should you close and relaunch Desktop, everything should be working as it was yesterday.

For clients with proxies, those that were using IPs to filter sites seemed to be OK, but there are a handful using FQDNs for whom, even when s3-proxy.shotgunstudio.com was allowed, they still weren’t able to use the app store. We noticed in some client logs that the URL that Desktop is trying to access is actually a tank.shotgunstudio.com one, and not our S3 proxy. This appears to be an error on our end, which we still have to track down.

Today is Canada Day :canada:, so some of the relevant parties on the engineering team are off today. We’ll look into this first thing tomorrow, but in the meantime, the rollback should get you all going.

Thanks very much for your understanding and sincere apologies for the shakeup.

2 Likes
9

Thank you for the quick reaction all, @tannaz .

Still haven’t been able to check how our filtering is set up. This might well have been the cause.

2 Likes
10

Hi all – some updates on this topic here:

2 Likes