October 2023 Summaries

Scaling up to enterprise-level demands rapid and secure software delivery, with GitLab introducing new AI-powered capabilities in its DevSecOps Platform to address these needs. The enhancements aim to improve collaboration, innovation, and compliance while fortifying digital defenses. GitLab Duo, a suite of AI tools, accelerates code development, operations, and security across the software lifecycle, offering features like vulnerability explanations and code suggestions. The platform supports enterprise needs by standardizing pipelines, integrating existing solutions, and allowing customizable settings to fit organizational workflows. Recent updates also include expanded GitLab Runner ecosystems, customizable user roles, and an enhanced navigation experience, all designed to provide distinct visibility and meet the unique needs of growing organizations. GitLab is committed to continuing its support for enterprise-class needs while maintaining quality and security standards as organizations scale their DevSecOps practices.

Atlassian is phasing out support for its Server products by February 15, 2024, prompting users who rely on these on-premises deployments to transition to alternatives such as Atlassian's Data Center or Cloud products, or explore other options like GitLab. Bamboo, a CI/CD solution under Atlassian, is one such product affected, and GitLab presents itself as a compelling alternative due to its integrated DevSecOps platform offering automation, scalability, and security benefits. The blog post provides a detailed comparison between Bamboo and GitLab CI/CD, highlighting differences in project structure, configuration methods, and deployment processes. GitLab uses a unified platform with configuration managed via a .gitlab-ci.yml file, while Bamboo relies on Projects and Plans, with configurations possible through Bamboo Specs. GitLab's CI/CD features include advanced security scanning, compliance policies, and the ability to define reusable CI/CD components, making it a comprehensive solution for users looking to migrate from Bamboo. The post also guides users through the process of converting Bamboo YAML Specs to GitLab CI/CD configurations, discussing aspects such as container images, stages, variables, build and deployment jobs, and artifacts management. It emphasizes the importance of planning the migration by aligning with stakeholders and understanding the necessary tools and dependencies before migrating projects to GitLab.

GitLab is implementing changes to access token policies, specifically removing support for non-expiring tokens as of Version 16.0, effective from May 2023. This change means that all personal, group, or project access tokens must now have an expiration date, set to a maximum of 365 days from their creation, to enhance security and minimize risks associated with long-lived credentials. Self-managed GitLab users upgrading from pre-16.0 versions will see tokens without prior expiration dates set to expire one year after their upgrade. To assist in this transition, GitLab offers features such as a token rotation API and email notifications for impending token expirations to help users manage and update their tokens proactively. These changes aim to balance security with usability, acknowledging the challenges of implementing effective security controls, while also providing administrators with tools to customize token lifecycles according to their security needs. Users are encouraged to audit their existing tokens, communicate changes within their teams, and utilize service accounts for automation where applicable, to ensure continued access and functionality within their GitLab environments.

Atlassian's upcoming end of support for Server products in February 2024 has prompted many organizations to consider migrating from Jira to GitLab for Agile planning, aiming to streamline processes and enhance team collaboration within a single DevSecOps platform. The blog provides practical tips for this migration, emphasizing the importance of understanding the current Jira setup to simplify configurations and recommending an initial integration of GitLab with Jira to ease the transition. Key features of GitLab, including groups, projects, labels, milestones, and iterations, are highlighted as tools to improve planning and manage organizational hierarchies effectively. The migration process is seen as an opportunity to clean up backlogs and focus on data crucial for ongoing work, using tools like the Jira issue importer and APIs for customized experiences. A pilot run with a simple team setup is advised to refine configurations and document best practices, while utilizing GitLab's wikis for knowledge sharing and progress monitoring through analytics to celebrate successes and learn from mistakes.

Lendlease, a multinational real estate company, has embraced GitLab's DevSecOps platform to drive a cultural transformation within its software development teams, aiming to enhance collaboration, visibility, and shared security responsibility across its global workforce. Chief Software Architect Ciaran Hennessy highlighted the impact of adopting an end-to-end platform that eliminates a complex toolchain, fostering cohesion in a hybrid work environment post-COVID-19 and ensuring 'radical visibility' among team members. This approach has enabled every team member, from executives to developers, to contribute to projects effectively, breaking traditional silos and promoting shared knowledge. The integration of security into the development process has shifted the mindset towards proactive security practices, making it a collective responsibility rather than an afterthought. By leveraging GitLab, Lendlease has also managed to integrate and modernize its legacy systems, making them accessible and functional for newer generations of developers through containerization. Additionally, Hennessy is optimistic about the role of generative AI in accelerating development processes, although he expresses concern about potential gaps in foundational skills among future developers. This strategic approach is part of Lendlease's broader objective to deliver innovative solutions through its core segments of investment, development, and construction.

The Eclipse Foundation, a significant entity in the open source ecosystem with over 415 projects, has recently joined the GitLab Open Source Partners community, enhancing its development platform with GitLab's integrated tools to improve productivity and reduce administrative tasks. Founded in 2004, the not-for-profit foundation focuses on fostering open source collaboration in various technology domains and has transitioned from a custom-built code hosting solution to GitLab's cohesive environment. This migration, managed by a dozen-member IT team, has streamlined operations and bolstered security initiatives, allowing the foundation to focus on expanding projects like the Eclipse Software Defined Vehicle community, which is seeing increased collaboration from major automotive and tech companies. The foundation is committed to enhancing security across its projects and invites GitLab community members to engage with its extensive array of open source projects.

Agile planning tools, such as Atlassian Jira, often use enforced status workflows to guide team members through workflows, but these can slow response times and limit team autonomy. GitLab offers an alternative by integrating agile planning tools within a single DevSecOps platform, which simplifies the process and enhances efficiency. Enforced status workflows specify the statuses a work item can transition through, often requiring manual data input and potentially hindering creativity and progress. GitLab addresses these challenges by using automation to improve data quality, protecting user experience through a preference for convention over heavy configuration, and simplifying tool integration and configuration. By allowing teams to focus less on managing configurations and more on innovation, GitLab's approach promotes collaboration, transparency, and faster market delivery while improving the overall developer experience.

The evolution of programming language learning has drastically shifted from the days of using pen and paper and CD-ROMs to an era marked by remote collaboration and artificial intelligence (AI). Today, tools like GitLab Duo Code Suggestions offer programmers an AI partner that assists by learning their style and providing contextually relevant code suggestions. This text explores how AI and modern development environments have transformed the learning process, exemplified by a tutorial on building a simple feed reader application in Rust. The tutorial guides users through setting up the development environment, defining RSS feed URLs, and using Rust modules and crates to parse XML feeds, optimize performance, and handle errors. The document emphasizes the advantages of parallel execution and asynchronous programming to improve efficiency and highlights how AI tools can accelerate the learning curve by generating boilerplate code and understanding algorithm purposes. The guide suggests further exploration into Rust's capabilities by experimenting with persistent storage, notifications, and various configurations to enhance the application's functionality.

On October 4, the developers of curl announced the upcoming release of version 8.4.0 to address a high severity vulnerability (CVE-2023-38545) that impacts curl and libcurl, leveraging a heap buffer overflow via the SOCKS5 protocol. GitLab investigated this vulnerability and confirmed that neither its GitLab.com nor GitLab Dedicated environments use SOCKS5, rendering them unaffected. However, self-managed customers using a SOCKS5 proxy should consult curl's security advisory to assess their exposure. The vulnerability affects libcurl versions 7.69.0 to 8.3.0, and upgrading to curl 8.4.0 is recommended for all affected users. GitLab's security and development teams took proactive measures to evaluate potential impacts on their platforms, users, and customers, emphasizing the security of their platform and customer data. They continue to monitor the situation and will provide updates as necessary.

Git 2.42, released on August 21, 2023, includes several enhancements contributed by GitLab's Git team, focusing on performance improvements, new features, and community growth. Key updates involve enhancements to the git pack-refs command, which now includes options to specify which references should or should not be packed, improving efficiency when managing temporary references during write-ahead logging. The git cat-file command has been updated to support a new -Z option that sets both input and output delimiters to the NUL character, resolving parsing issues in error messages. Another notable improvement is the ability to pass pseudo-options through stdin in git rev-list, enhancing flexibility in computing sizes for forked repositories. Additionally, the release includes code and test improvements, showcasing style modernization and refactoring efforts by GitLab engineers to align with current coding standards.

GitLab has introduced its first active check for browser-based dynamic application security testing (DAST), enhancing the tool's ability to detect path traversal vulnerabilities in modern web applications. This new feature, available in GitLab 16.4 or DAST 4.0.9, replaces the previous ZAP alerts with GitLab's own active checks, aiming to improve vulnerability detection for developers and security teams. Active checks involve a series of attacks on web applications to identify weaknesses, utilizing different techniques such as match response, timing, and callback attacks. Each attack injects specific payloads into HTTP requests, testing various injection locations like cookie values and query parameters, and uses the HTTP responses to assess the success of the attack. The GitLab active checks are automatically implemented during full scans, though users can opt out by modifying a CI/CD variable. The system prioritizes match response and timing attacks, written in YAML for quick updates, while callback attacks focus on detecting unauthorized data exposure.

GitLab's Data Science team is enhancing its predictive model workflows by incorporating DevSecOps practices to address common challenges such as error-prone manual steps, difficulty in replicating experimental results, and lengthy machine learning model training times. By utilizing the GitLab DevSecOps Platform, the team automates and standardizes various stages of their data science pipelines, including building a common container image for reproducibility, automating model training with GPU-enabled CI/CD, and leveraging experiment tracking for metadata and artifact storage. The use of GPU hardware significantly speeds up model training, while the GitLab Container Registry ensures efficient management of dependencies. These practices not only streamline the development process but also lay the groundwork for future MLOps advancements, which will include enhanced security features and workflow monitoring. The initiative is part of GitLab's broader strategy of "dogfooding" its platform capabilities to improve its own development processes.

GitLab's translation efforts have been significantly bolstered by contributions from software and computer engineering students at Ajou University in South Korea, guided by Professor Hwanyong Lee. These students participated in a classroom project that led to the complete translation of the GitLab user interface into Korean. This initiative was part of a broader educational strategy to engage students in open-source projects, emphasizing the importance of such contributions and fostering a sense of community involvement. The translation project, which took about two months, involved seven students who tackled challenges like maintaining consistency and adapting to new expressions with each GitLab update. They developed a glossary to ensure uniformity and consulted the Korean TTA standards dictionary for guidance. These efforts not only enhanced the accessibility of GitLab for Korean users but also instilled a sense of pride in the students as they realized their capacity to impact the open-source community. The project underscores the vital role of translations in bridging linguistic gaps and making technology more inclusive, with proofreaders playing a crucial part in maintaining translation quality.

GitLab 17.0, scheduled for release in May 2024, will include an upgrade to the container-optimized operating system (COS) for ephemeral VMs used by SaaS runners on Linux, featuring a Docker Engine update from version 19.03.15 to 23.0.5. This update introduces compatibility issues for jobs using Docker-in-Docker and Kaniko with outdated versions, leading to errors unless updated. The change will specifically impact the fleet of SaaS runners on Linux tagged as saas-linux-*-amd64, while those on macOS and Windows remain unaffected. To mitigate potential disruptions, users should update their Docker-in-Docker jobs to Docker version 20.10 or newer and their Kaniko jobs to version v1.9.0 or newer, ensuring explicit version referencing in job definitions to prevent failures during image updates.

GitLab has significantly advanced its DevSecOps platform, providing organizations with a comprehensive solution that simplifies the software development lifecycle by integrating continuous integration and continuous delivery (CI/CD) capabilities enhanced by artificial intelligence (AI). The platform, which recently surpassed 1 billion pipelines, supports diverse industries by automating code building, testing, packaging, securing, and deploying, thereby improving code quality and reducing release cycles. Notable features include AI-powered tools like Code Suggestions and Suggested Reviewers, which enhance productivity and efficiency, while integrated security measures such as static and dynamic application security testing (SAST and DAST) ensure robust software security. GitLab's commitment to customer-driven innovation and collaboration within its community fosters continuous improvement, addressing challenges like time-to-market pressures and toolchain complexity. GitLab's ongoing enhancements, such as a CI/CD catalog and customizable roles, aim to further streamline DevSecOps processes, underscoring its leadership in the 2023 Gartner Magic Quadrant for DevOps Platforms.

Vladislav Nechakhin, a prominent bug bounty hunter and application security engineer, shared insights into his hacking journey and offered advice during a GitLab AMA session. Nechakhin, known for his contributions to open-source security projects, emphasized the importance of developing a deep understanding of systems and focusing on personal interests to excel in bug hunting. He discussed the challenges of demonstrating the impact of vulnerabilities and the necessity of balancing technical findings with business risks. Nechakhin highlighted the GitLab Security team's transparency and maturity, contrasting it with other programs. He also addressed the interplay between user interface design and security, alongside the dual impact of AI on the bug hunting process. The session concluded with personal anecdotes and an overview of GitLab's bug bounty program, which has awarded over $3.5 million in bounties since its inception.

GitLab's second annual EMEA Partner Leadership Summit in London celebrated the achievements of its channel, technology, and cloud partners by recognizing them through the Partner Leadership Awards. Key award winners included SVA System Vertrieb Alexander GmbH as EMEA Partner of the Year for their dedication to DevSecOps and customer engagement, and Infograb LC as APAC Partner of the Year for their growth in the GitLab practice and success in Korea's enterprise market. Amazic was awarded EMEA Distributor of the Year for their focus on developing a DevSecOps ecosystem, and Adfinis received EMEA Services Partner of the Year for their commitment to open source solutions and professional services capabilities. GitLab aims to foster collaborative relationships and encourages its partners to align with its values of Collaboration, Results, Efficiency, Diversity, Inclusion & Belonging, Iteration, and Transparency (CREDIT), with each awardee demonstrating strong partnership and alignment with these principles.