January 2023 Summaries

Open source software has become a mainstream topic in the software industry, prompting organizations to explore best practices for engaging with it. Many companies form open source program offices (OSPOs) to lead their efforts in the open source ecosystem, capitalizing on the innovation and security benefits it offers. The OSPO Alliance, established in 2021, aids organizations in navigating this space by providing resources like the Good Governance Initiative (GGI) Handbook, which outlines 25 adaptable best practices for engaging with open source. To facilitate the implementation of these practices, the Alliance launched the MyGGI project, enabling organizations to quickly set up their own OSPO infrastructure using GitLab. This project provides a framework for tracking progress through scorecards and iterating on activities in a way that suits the organization's specific context. The deployment process involves creating a GitLab project, configuring access tokens, and running a CI/CD pipeline to establish a dynamic static website that tracks the organization's open source activities. This tool supports the visualization and management of open source initiatives, helping organizations structure and manage their engagement with open source projects effectively.

A DevSecOps platform, such as GitLab, offers a centralized system to streamline the software development lifecycle by integrating with various third-party tools and systems, enabling organizations to maintain a unified experience for stakeholders, developers, and operators. GitLab can integrate with cloud providers, legacy applications, and web services, offering four main approaches: deploying client applications or hosting GitLab runners on external platforms, hosting GitLab Server on various infrastructures, integrating with the development cycle using APIs and webhooks, and deep application integration with advanced external services that require thorough testing. These integrations facilitate enhanced collaboration, efficiency, and performance monitoring across development environments, while GitLab tools like the GitLab Performance Tool and GitLab Browser Performance Tool support the optimization and validation of integration processes.

In 2023, organizations are expected to continue integrating security deeply into their DevOps processes, evolving into DevSecOps to address the growing threats in software development. This shift, as predicted by GitLab experts, will emphasize supply chain security, leveraging AI/ML for automation and efficiency, and implementing value stream analytics for comprehensive insight into organizational value delivery. The focus will include embedding security education within DevOps training, thereby equipping future professionals with essential security skills. Additionally, the adoption of zero trust strategies and regulatory requirements around practices like software bill of materials (SBOM) generation will become more prevalent. Observability is predicted to advance within the software development lifecycle, enhancing efficiency in DevSecOps workflows through technologies like eBPF, which enable automated code instrumentation. These developments are expected to drive significant transformation in how organizations manage security, productivity, and compliance within their software development processes.

Participating in an open-source security audit of Git, funded by the Open Source Technology Improvement Fund and conducted by X41 D-Sec, led to the discovery of the critical vulnerability CVE-2022-41903. This collaborative effort involved members from GitLab's security team, including the author, who was eager to join the audit due to previous experiences with Git vulnerabilities. The team efficiently set up a collaboration environment using GitLab's infrastructure, allowing them to document findings and communicate effectively. The audit focused on high-priority areas within Git's extensive codebase, revealing the vulnerability through an intricate process of examining less obvious features and documentation. The discovery of CVE-2022-41903, related to the handling of padding specifiers in Git's pretty format, prompted early communication with the git-security mailing list to maintain discretion while addressing the issue. This collaboration not only highlighted the importance of thorough security audits but also strengthened Git's security, benefiting both GitLab and the broader software development community.

Amidst the challenges of balancing innovation with cost efficiencies in 2023, GitLab introduces two beta releases designed to enhance developer support and software delivery efficiency. The GitLab Value Streams Dashboard, available in private beta, offers stakeholders real-time visibility into software development metrics, enabling more informed decision-making and reducing developer idle time by addressing obstacles before they arise. This dashboard helps teams improve productivity and efficiency by tracking key DevOps metrics, identifying bottlenecks, and promoting best practices. Meanwhile, GitLab Remote Development allows developers to work in customizable environments without managing local setups, minimizing distractions and maximizing satisfaction, which can lead to greater productivity and creativity. Featuring a new Web IDE Beta with a VS Code interface, this tool facilitates secure connections to remote environments and supports compliance with organizational security policies. Both innovations are part of GitLab's single DevSecOps platform, aiming to streamline software creation and enhance overall value delivery.

GitLab has introduced a beta feature for migrating projects by direct transfer, enhancing the capability to migrate GitLab group and project resources seamlessly across instances without manual file exports. This feature, available from version 15.8, simplifies the migration process by allowing users to transfer data directly using the UI or API, effectively mapping user contributions and associations, which were previously linked to the importer. While the feature is enabled by default on GitLab.com, self-managed instances require some configuration. As the feature progresses towards production readiness, GitLab plans to phase out the file export method, although it will remain available for air-gapped networks until an offline solution is developed. Future enhancements aim to improve efficiency for large projects, provide better migration feedback, and support more granular imports, including subgroup migrations and specific project selection. The ongoing development focuses on making the direct transfer method more robust and user-friendly, with GitLab seeking user feedback to refine and expand the feature set.

Beginning February 1, 2023, GitLab implemented a policy requiring only prelisted support contacts, designated through company representatives, to open support tickets, enhancing security and management control for customers. This change aims to expedite triaging requests and ensure that authorized contacts receive prompt assistance without the previous delays caused by needing to verify entitlements. Prior to this policy, anyone could open a ticket, but responses were limited to users associated with paid accounts, often resulting in delays due to entitlement verification. The new system provides increased security by allowing customers to manage and quickly update their list of support contacts, tighter control by ensuring only authorized personnel can request support, and reduces ambiguity by clearly defining who can access support. This shift is designed to grant customers greater flexibility and control over their interactions with GitLab Support.

GitLab has introduced new default typefaces, GitLab Sans (based on Inter) and JetBrains Mono, as part of its rebranding effort to enhance user experience by ensuring brand continuity, improving readability, and addressing consistency issues. The company chose these open-source typefaces because they are specifically designed for digital interfaces, offering features like increased distinction between similar characters and compatibility across platforms. By moving away from system fonts like San Francisco and Segoe UI, the update aims to reduce inconsistencies caused by varied font characteristics, such as x-height and character width, which previously led to design and experience challenges. This transition also helps in refining typography decisions, such as disambiguation, visual weight, and type scales, while aligning with GitLab's open-source values. The changes, which include updates to type scales and design resources, are intended to make the user interface more cohesive and content more consumable, although they may initially reveal other inconsistencies that need addressing.

Adopting a DevSecOps platform can significantly benefit startups and small to medium-sized businesses (SMBs) by supporting their growth in customer base, revenue, and industry standing. Implementing a single, end-to-end platform early on helps avoid the development of inefficient practices, reduces complexity, and prevents the formation of operational silos by fostering a collaborative environment. This collaboration encourages innovation and integrates automation into processes, reducing the burden on limited IT staff by minimizing repetitive tasks and potential human errors. GitLab's DevSecOps platform, for instance, offers these benefits by providing a unified work environment that enhances communication and efficiency without the need for additional tools. This early adoption ensures that businesses can scale effectively while maintaining a collaborative culture, ultimately leading to the creation of better software and a stronger foundation for future growth.

GitLab has enhanced its integration capabilities with Atlassian Jira by introducing the GitLab for Jira app, which supports both GitLab SaaS and GitLab Self-Managed, facilitating easier integration for various installation types. This collaboration aims to streamline the DevOps process by displaying key development metrics like merge requests and commits directly in the Jira Development Panel, thereby enhancing communication and reducing context-switching for developers. The integration allows for features such as issue transitioning from commits and the addition of time tracking through Smart Commits. As part of this initiative, support for Jira Cloud within the DVCS integration is being deprecated in favor of the GitLab for Jira app, which is now the recommended pathway for integrating Jira Cloud with GitLab. The configuration process is simplified through the Atlassian Marketplace, though it requires administrative roles in both Jira and GitLab for setup.

Insecure web applications are prevalent and pose significant risks as they can easily be exploited if left unmonitored. The blog post discusses how to build a monitoring solution for web applications using GitLab CI/CD, GitLab Pages, and several free open-source security tools. By setting up a project in GitLab, users can automate the process of identifying web services across specified addresses, capturing screenshots of these services, and generating a static website for visual review of the findings. This setup involves writing automation scripts, configuring a pipeline with defined stages for scanning and deploying, and scheduling regular runs to maintain vigilance over the web application environment. The solution aims to provide a comprehensive overview of web applications, enabling users to detect potential vulnerabilities proactively. Additionally, the post encourages sharing creative uses of GitLab and engaging with their security team for further insights or suggestions.

DevOps professionals with security expertise are costly and scarce, posing challenges for startups and small to medium-sized businesses (SMBs) that lack the financial resources to hire them. As a result, these businesses often resort to hiring consultants or, worse, forgoing security measures altogether, which can jeopardize their operations and customer safety. A viable solution is adopting a DevSecOps platform, which integrates security throughout the software development process, allowing for early detection of vulnerabilities and automation that reduces human error and compliance challenges. Platforms like GitLab offer SMBs comprehensive security without the need for multiple tools or security consultants, embedding security and compliance into the workflow from start to finish. This approach not only enhances security but also streamlines operations, helping businesses navigate economic uncertainties and competitive pressures while focusing on innovation.

Incident metrics are critical for DevSecOps teams to effectively track and improve their incident response processes, minimizing both the impact on customers and costs to the business. By capturing five key timestamps—start time, impact detected, response initiated, impact mitigated, and end time—teams can accurately measure incident metrics such as time to detection, mitigation, and recovery. GitLab facilitates the creation of incident timelines, which serve as a single source of truth by documenting essential events during an incident. An illustrative example involves an engineer named Sally, who, after initially missing an alert, determines the incident's true start time, initiates a response, and successfully mitigates the issue by coordinating a rollback. The incident timeline records these events, allowing the team to measure and analyze response times to enhance future performance. GitLab is developing an MVC for incident tags, enabling teams to efficiently capture and add relevant timestamps to the timeline, thus improving incident management strategies.

Vestiaire Collective transitioned to GitLab in 2018 to enhance the speed and flexibility of their code reviews and release pipelines, migrating from Subversion for improved maintainability and easier code reviews. The integration of GitLab with tools like Jenkins, Jira, and Nexus has allowed the company to streamline its complex toolchains, boosting productivity, while the introduction of GitLab's container registries has resolved geographic latency issues previously encountered with Amazon ECR. The company's engineering team, including data scientists, has embraced GitLab's capabilities for managing code repositories and releases, and the platform's transparency and performance have been well-received. Looking ahead, Vestiaire Collective aims to fully integrate project management into GitLab, explore more automation tools, and potentially deploy their GitLab setup on a Kubernetes cluster to enhance stability and functionality.

GitLab is introducing a feature that will automatically revoke Personal Access Tokens (PATs) when detected in public repositories by its Secret Detection tool to enhance user and organizational security. Leaked PATs pose significant security risks as adversaries can exploit them, and the feature aims to mitigate such risks by invalidating exposed tokens. The feature applies to public projects using Secret Detection and will revoke tokens committed on the default branch that include the "glpat-" prefix. This change is being rolled out in phases, starting with GitLab.com from January 23, 2023, and for GitLab Self-Managed in version 15.9, with the possibility for early opt-in. Users are advised to replace compromised tokens and consider separate tokens for different use cases, while GitLab continues to develop and enhance its Secret Detection capabilities.

Over two decades ago, "The Pragmatic Programmer" introduced the DRY principle, emphasizing the importance of minimizing duplication in systems by ensuring each piece of knowledge has a single representation. In modern development environments, especially within DevOps, balancing new feature development with maintaining existing code is crucial, and reducing duplicate knowledge across projects is an ongoing challenge. This tutorial highlights mechanisms in GitLab that utilize the DRY principle to reduce code duplication and standardize knowledge, such as using YAML anchors, extending blocks of CI workflows, and leveraging downstream pipelines to break out microservices. These techniques improve readability and ownership of code by transforming a single .gitlab-ci.yml file into multiple files. Additional GitLab features like CI/CD variables, description templates for consistent code reviews, and project templates for initializing new projects further support best practices. Emphasizing the creation of a "Pipeline Center of Excellence" project can help organizations adopt consistent CI/CD workflows by utilizing well-defined templates and abstracted constructs, ensuring development teams can easily adopt best practices without reinventing the wheel.