May 2015 Summaries

The Logjam vulnerability, which allows attackers to perform a man-in-the-middle attack by downgrading a TLS connection to 512-bit DH parameters, has implications for GitLab security. GitLab installations are generally safe due to the use of up-to-date SSL ciphers and 1024-bit DH groups by default, but there remains a potential risk from nation-state attackers. To mitigate this, GitLab users can upgrade to 2048-bit DH groups by generating and configuring new parameters in the NGINX settings. The process varies slightly depending on whether GitLab is installed via omnibus-gitlab packages or from source. For GitLab.com, the service currently uses 1028-bit DH groups and has not transitioned to 2048-bit groups due to compatibility issues with older Java-based clients, but the team is exploring solutions to maintain security without disrupting service accessibility.

In early 2015, GitLab acquired Gitorious, sparking mixed reactions within the free software community due to concerns about software freedom and licensing. Mike Gerwitz, a free software advocate, initially approached GitLab's CEO, Sytse Sijbrandij, with apprehension regarding GitLab's permissive Expat license, which allows for proprietary derivatives. However, Gerwitz was pleasantly surprised by Sijbrandij's openness to community feedback and his commitment to addressing concerns, particularly regarding the liberation of client-side JavaScript from GitLab's proprietary Enterprise Edition. This collaboration led to a license change that ensured all JavaScript served to clients would be free, demonstrating GitLab's willingness to align some of its practices with free software principles. While fundamental disagreements remain, such as GitLab's "open core" business model, the company's actions, especially in response to community input, have been viewed as encouraging steps towards supporting software freedom.

GitLab is developing a version check function to address the issue of outdated servers, which pose security risks and degrade user experience. This feature will inform users of their server's status using a color-coded image system on the /help page, indicating whether their version is up-to-date, outdated, or missing a security update. The system will log requests with timestamps and server hostnames while excluding user IP addresses, aiming to gather insights on GitLab usage without compromising privacy. Although this initiative requires ongoing maintenance, users can opt-out to prevent external connections if desired. Feedback is encouraged, and adjustments include utilizing HTTP referer headers for data collection instead of embedding hostnames in picture request URLs.

GitLab CI, a continuous integration tool integrated with every GitLab installation, is undergoing a significant enhancement by adopting a new configuration method using a .gitlab-ci.yml file, inspired by Travis CI. This change will allow users to specify build scripts directly within their repositories, offering benefits such as version control, the ability to maintain different builds for different branches, and a single source of truth accessible to any team member with repository access. This advancement also facilitates complex build matrices, enabling the automatic generation of jobs based on different environments and dependencies, thus simplifying the setup of intricate test suites. The forthcoming update, which will be part of GitLab 8.0, aims to replace the existing job configuration method to streamline usage, improve documentation, and make development and debugging more straightforward, although it represents a breaking change for current GitLab CI users.

An alternative CI runner written in Go, initially developed as an unofficial GitLab Runner, has now been adopted as the official GitLab CI runner, replacing the older Ruby-based version. This new runner, which supports technologies like Docker and allows for multiple concurrent jobs, is available as a single binary that can be easily deployed on any server. Users who are satisfied with the older runner are not required to switch unless they need the new features. The GitLab CI Multi-purpose Runner's resources and documentation have been centralized in the official GitLab repository, providing guidance for setup and project building. The installation process accommodates various systems, including Debian, Ubuntu, CentOS, RedHat, macOS, Windows, and Docker. The developer has joined the GitLab Core Team, aiming to enhance the CI solution's simplicity and robustness.

Debian is a favored platform for running GitLab, and with the release of Debian 8, GitLab has ensured compatibility for early adopters by providing GitLab Omnibus packages for this version, which are accessible on their downloads page. In addition, GitLab is operating its package server in collaboration with Packagecloud.io, currently in beta. Users can install the GitLab Community Edition on Debian 8 through a simple command line using curl and apt-get, facilitating easy access and installation for users looking to run GitLab on the latest Debian release.