September 2023 Summaries

An increase in password attacks targeting GitLab.com’s OAuth API endpoint was identified by the security team starting September 22, 2023, with the attacks being automated and focusing on accounts with simple usernames. While GitLab’s security remains intact, the company is enhancing its security measures and monitoring activities to prevent account compromises. GitLab recommends users enable two-factor authentication and has updated its product to minimize lockouts for such accounts. Additional precautions include enforcing two-factor authentication at the GitLab layer, using the Restrict Group Access by IP Address feature to limit access, and implementing Git Abuse Rate Limiting to manage excessive repository activities. Users are advised to maintain strong, unique passwords, change them regularly, and stay alert to phishing attempts, reporting any suspicious activities immediately.

Microcks is an open-source, Kubernetes-native tool designed to address challenges in API development, such as creating a fast feedback loop on design, enabling team autonomy, and ensuring backward compatibility. It allows developers to mock and simulate APIs using various protocols like OpenAPI, GraphQL, and gRPC, facilitating rapid design iteration and easing the setup of complex environments. By integrating with GitLab, Microcks enhances collaboration and automation in API-based application development, offering seamless identity management and shared API simulations through GitOps deployment. Additionally, it supports contract-testing to validate API conformance and backward compatibility, integrating smoothly into CI/CD pipelines. The tool's deployment flexibility, including centralized instances and lightweight CLI for pipeline integration, makes it a cost-effective solution for maintaining quality assurance environments. The blog series aims to explore Microcks' use cases, its integration with GitLab, and how it simplifies the API lifecycle, as explained by experts Laurent Broudoux and Madou Coulibaly.

Colmena is an open-source project developed to empower indigenous and community media outlets in the Global South by enabling them to create, share, and distribute hyperlocal media content globally. The project, supported by DW Akademie and the Mexican NGO Redes por la Diversidad, Equidad y Sustentabilidad A.C., emerged during the COVID-19 pandemic and is funded by the German Federal Ministry of Economic Development and Cooperation. It functions as a mobile digital newsroom offering tools for audio streaming, podcast production, mobile recording, and editing, available in eight languages. Built on a federated architecture, Colmena uses GitLab as a development platform to manage code repositories, documentation, and support for community partners, emphasizing collaboration and open access. The project is designed to uphold human rights and freedom of expression while maintaining a community-driven approach to address the specific needs of its media partners, referred to as "communities of practice."

As the February 2024 end-of-life date for Atlassian Server approaches, businesses relying on these on-premises tools for software development must decide whether to transition to Atlassian Cloud, Atlassian Data Center, or an alternative solution like a unified AI-powered DevSecOps platform. GitLab offers a streamlined migration path with importer tools for repositories, Jira issues, and Bamboo jobs, presenting an opportunity to consolidate toolchains and enhance developer productivity by reducing complexity and improving security. The 2023 Global DevSecOps Survey highlights that most organizations use multiple DevOps tools, leading to inefficiencies and significant time spent on maintenance and integration. By migrating to a single platform like GitLab, companies can reap benefits such as cost savings, increased efficiency, better security, and improved developer satisfaction. The comprehensive platform fosters collaboration, reduces context switching, and provides enhanced visibility across the software development lifecycle, enabling teams to deliver software more quickly and securely. GitLab's range of deployment options aims to facilitate a smooth transition, ensuring that organizations can meet their unique needs while enhancing their software development processes.

GitLab has achieved the AWS DevSecOps Partner Competency designation, which is a sub-specialty of the AWS DevOps ISV Partner Competency category, signifying that AWS has vetted GitLab's capabilities and use cases. This recognition highlights GitLab's strength in providing a DevSecOps platform that integrates security seamlessly across development and delivery cycles, offering rapid and contextual feedback to development, security, and operations teams. GitLab's AI-powered platform enables organizations to shift left on vulnerability remediation, meaning developers can address security defects with minimal friction, as vulnerabilities are identified shortly after code changes are introduced. The platform provides remediation guidance, including on-demand training and automated fixes, and supports collaboration for managing vulnerabilities effectively. GitLab will be present at AWS re:Invent 2023 at Booth 1152.

In the fast-paced world of software development, the process of finding the right code reviewer can create delays and bottlenecks in the development cycle. GitLab's Suggested Reviewers feature aims to address this challenge by using a machine learning algorithm to propose up to five reviewers with relevant expertise for a merge request (MR). This tool analyzes changes in an MR and a project's contribution graph to provide contextual reviewer suggestions, which are continuously updated based on additional commits. By streamlining the reviewer selection process, Suggested Reviewers saves time, enhances collaboration, and improves code quality, ultimately resulting in a more agile and efficient development workflow.

The tutorial delves into the use of feature flags as a progressive delivery technique in continuous delivery (CD), aimed at reducing deployment risks by allowing developers to perform controlled testing in production environments. Feature flags enable developers to specify which features are deployed and to whom, facilitating experimentation without affecting all users. The guide illustrates the implementation of feature flags using GitLab, involving steps to set up a Kubernetes cluster, import and manage projects, and configure feature flags for different environments. It highlights the benefits of feature flags such as lower risk, ease of use, and enhanced compliance through audit capabilities. The tutorial includes a practical segment using a fictitious inventory management application, demonstrating how to create, configure, and apply feature flags, followed by testing these flags in both staging and production environments to ensure functionality. It emphasizes the importance of audit events in tracking changes to feature flags for compliance and risk management, ultimately offering a comprehensive approach to deploying updates with minimized risk.

In June, the NSA and CISA issued a joint cybersecurity information sheet (CSI) with recommendations for securing cloud-based DevSecOps environments, particularly focusing on CI/CD cloud deployments. These environments have become attractive targets for malicious actors due to risks like insecure code and pipeline execution, insufficient access controls, and exposure of secrets. GitLab, as an all-inclusive DevSecOps platform, supports the implementation of recommended mitigations by providing features for authentication, access control, secure code signing, two-person review rules, least-privilege access policies, and secure handling of secrets. GitLab also integrates security scanning tools within the CI/CD pipeline and offers functionalities such as secret detection, license compliance, and audit logging to enhance security. Additionally, it facilitates the management of software composition through features like dependency lists and supports resiliency through robust business continuity strategies. As a strategic partner, GitLab aligns with NSA and CISA's guidance to help organizations protect their CI/CD environments and expedite secure software development.

In a reflection on a significant incident from 2005, a Debian Linux distribution project maintainer recounts how a broken release of the grep tool disrupted many developers' systems and highlights the evolution and impact of Salsa CI, a custom-built continuous integration tool within Debian's GitLab instance, Salsa. This tool has significantly enhanced the Debian software development process by enabling maintainers to streamline package maintenance, reduce errors, and accelerate workflows through automated testing across multiple architectures. Salsa CI has transformed what was once a manual, error-prone task into an efficient, automated process, greatly reducing the time required to identify and resolve issues. The tool is credited with improving the reliability of packages migrating from Unstable to Testing and has also inspired other open-source projects, such as Kali Linux, to adopt similar practices. The success of Salsa CI is celebrated within the Debian community and is gaining recognition in the broader open-source ecosystem for its positive impact on software development practices.

Starting from GitLab 16.6, set to release on November 16, 2023, the company's monthly release schedule will shift from the 22nd of each month to the third Thursday, enhancing consistency and predictability for customers by standardizing the release day. This change mainly impacts users of GitLab self-managed, who will need to adjust any processes or automation previously aligned with the 22nd release date, whereas GitLab.com SaaS users will experience no significant changes as the service continues its multiple daily deployments. For convenience, a new rolling 12-month schedule detailing these changes is available on the releases page, along with a machine-readable version at data/releases.yml.

GitLab's Vulnerability Report facilitates seamless management of security scan results within the platform, allowing users to manage code, run security scans, and address vulnerabilities without needing to switch tools. While some teams prefer separate tools like Jira for vulnerability management, GitLab provides easy export options, such as CSV for external analysis or PDF for simplified presentation. Using GitLab's API, vulnerability data can be exported to HTML/PDF or integrated into Jira projects. This blog explains how to export reports to HTML/PDF by forking or importing a specific project, configuring CI/CD variables, and running a pipeline to generate downloadable files. Similarly, vulnerabilities can be exported to Jira by leveraging GitLab and Jira APIs to create individual tickets for each vulnerability, with the capability to prevent duplicate tickets through search queries. The scripts used for these exports are for educational purposes and are not officially supported by GitLab.

The text provides a detailed guide on configuring SAML and SSO on GitLab.com to enhance security and streamline access management. SAML is described as an open standard for sharing authentication data between service providers and identity providers (IdPs), while SSO allows users to log into multiple services with a single set of credentials. Implementing SSO on GitLab.com, particularly for Premium and Ultimate tiers, requires specific information from the IdP and can be enforced for both web and Git proxy activities to improve security. The text emphasizes the benefits, such as reducing password bloat and centralizing authentication, and discusses the use of SCIM for automated provisioning and deprovisioning. Enterprise users on GitLab have additional management functionalities, and specific settings can restrict project and group creation to protect intellectual property. The guide also explores role management through SAML Group Sync, allowing for flexible and automated role assignments based on IdP group memberships, and recommends setting default membership to "Minimal Access" to maintain the principle of least privilege.

This tutorial provides a concise guide on hosting and deploying VueJS applications for free using GitLab Pages and GitLab CI/CD. It begins with the setup of a VueJS application using the Vue CLI, followed by creating a `.gitlab-ci.yml` configuration file necessary for deployment. The instructions detail the process of configuring the Vue project to ensure build artifacts are placed in the 'public' folder, which GitLab Pages uses for deployment. Adjustments to the `vue.config.js` file are recommended to modify the `publicPath` and `outputDir` settings, ensuring the application is correctly deployed at the specified base URL. By following these steps, users can successfully set up a CI/CD pipeline for their VueJS project, allowing seamless hosting on GitLab Pages.

GitLab has collaborated with Sigstore to offer a more secure and simplified approach to cryptographic key management by adopting keyless signing through Sigstore's Cosign utility. Traditional key management, which involves generating, storing, and distributing cryptographic keys, presents significant challenges in terms of complexity, security risks, and operational inefficiencies. Keyless signing addresses these issues by using ephemeral keys generated for short-lived periods, reducing the risk of exposure and simplifying key management processes. This method enhances security by eliminating the need to store private keys and provides comprehensive audit trails and logging for regulatory compliance. In GitLab's implementation, Cosign integrates with the GitLab CI/CD pipeline, allowing users to sign artifacts effortlessly by incorporating a few lines in a yml file. The process involves generating a temporary key pair that is logged on a certificate transparency log, ensuring signing events can be publicly audited without the need for ongoing key management tasks like rotation and distribution. This integration is available across all tiers of GitLab SaaS, simplifying workflows and increasing system-wide security.

AI is profoundly impacting various industries, particularly software development, as highlighted in GitLab's Global DevSecOps Report on the state of AI in this field. The survey of over 1,000 technology leaders reveals widespread enthusiasm for AI's potential to drive business innovation, despite significant concerns about privacy, security, and intellectual property risks. While the majority recognize the necessity of implementing AI to remain competitive, 79% express concerns about AI tools accessing sensitive information, and 48% worry about the copyright status of AI-generated code. To mitigate risks, deploying AI initially in low-risk environments is recommended for organizations to develop best practices. The report also notes that AI can enhance productivity across the software development lifecycle, although it may increase workloads for security teams. A gap in AI training resources is identified, with many practitioners seeking additional learning opportunities independently, indicating a need for comprehensive, up-to-date training programs. GitLab envisions its AI-powered DevSecOps platform as a means to integrate AI securely across development processes, advocating for a privacy-first approach to maximize the benefits of AI while ensuring data protection.

The Arch Linux community undertook a comprehensive migration to the GitLab DevSecOps Platform over the past three years to modernize its software development processes, culminating in the recent transfer of its entire packaging toolchain from Subversion to Git and GitLab. This significant transition, involving nearly 14,000 packages and over 12,000 individual Git repositories, aims to enhance collaboration, visibility, and efficiency by leveraging GitLab's collaborative features and modern version control capabilities. The migration, executed meticulously with the help of custom scripts and thorough preparation, not only involved transferring historical data but also reimagining workflows and tools to foster a more integrated and engaging community environment. By adopting GitLab, Arch Linux has improved its ability to collaborate and automate, ultimately strengthening its community and aligning with contemporary open-source development practices. This shift exemplifies Arch Linux's commitment to adapting to technological advancements and optimizing its infrastructure for future growth.

GitLab is enhancing the software development process by integrating AI tools, transforming the traditional lifecycle into an AI-powered DevSecOps model. This approach not only lowers barriers for contribution but also positions companies to evolve into AI-first organizations. Through a detailed scenario involving a financial services firm, the text illustrates how GitLab's AI capabilities, such as GitLab Duo, can streamline the development of an AI-enabled Q&A system. Key features include AI-driven text summarization for issue tracking, LLM-based requirements management, and generative AI for code suggestions and test generation. These tools improve collaboration, reduce repetitive tasks, and accelerate development while maintaining quality through AI-enhanced code reviews and CI/CD methodologies. GitLab's AI integration ultimately aims to deliver robust solutions efficiently by minimizing context switching and enhancing the software delivery experience.

GitLab serves as an all-encompassing platform for managing the DevSecOps lifecycle, facilitating faster and more efficient software development while extending its capabilities to support ISO 27001 compliance. The 2022 edition of the ISO standard introduced new controls focused on secure coding and configuration management, highlighting the increased emphasis on software security. GitLab aligns with these updates by offering features such as role-based access control, SAML SSO, SCIM integrations, and comprehensive project management tools that integrate information security throughout all phases of a project. Additionally, GitLab's infrastructure-as-code scanning, compliance pipelines, and audit event tracking provide robust support for managing technical vulnerabilities and ensuring compliance with internal and external requirements. The platform's Secure stage features, including SAST, DAST, and dependency scanning, enhance the security of the software development lifecycle by enforcing secure coding principles and compliance through merge request approvals. GitLab's change management capabilities, such as protected branches and merge request approvals, further ensure a structured and secure approach to software development, positioning GitLab as a strategic partner in achieving ISO 27001 compliance and improving software quality.

Migrating to the cloud presents both opportunities and challenges for companies, enabling faster software releases but also introducing complexities such as data security, compliance, and configuration management. According to GitLab's 2023 Global DevSecOps Survey, organizations with at least 25% of their applications in the cloud are twice as likely to release software faster than a year ago. However, the process involves overcoming significant hurdles, such as moving complex data, avoiding security pitfalls, automating compliance, and managing configuration challenges. Abubakar Siddiq Ango and Fatima Sarah Khalid from GitLab suggest that leveraging a unified DevSecOps platform like GitLab can streamline these tasks by offering features that automate security scanning, compliance, and configuration, while supporting multi-cloud strategies and reducing dependency on vendor-specific tools. This platform simplifies the cloud migration process by providing a centralized solution for deployment, security, and collaboration, making it easier, faster, and more cost-effective for teams to adapt to cloud environments.

Cisco Systems, Inc.'s learning and certification division has experienced significant improvements in collaboration and production speed after adopting the GitLab DevSecOps Platform, as discussed by principal engineer Hank Preston during GitLab's DevSecOps World Tour in Chicago. This transition has streamlined their toolchain, enhanced version control, and established a single source of truth, thus reducing the complexity of managing multiple tools and increasing accountability within the team. Preston emphasized the importance of having an integrated platform to manage source and version controls more effectively and discussed the implications of artificial intelligence (AI) in software development, including concerns about intellectual property and the potential impact on how new developers learn coding skills. Despite the apprehensions about AI, Cisco is considering its use under strict standards and addressing intellectual property issues, although they currently do not allow AI-generated code in their development processes. The platform used by Cisco also supports their digital learning offerings, which provide employees with access to training resources and certifications like CCNA and CCIE.