Stan Hu authored 2 years ago and Ezekiel Kigbo committed 2 years ago

In FIPS mode, if a deploy key were present, clicking on the "Allowed
to push" dropdown would fail with a "Failed to load groups, users and
deploy keys" message. This occurred because the JavaScript attempted
to use the `fingerprint` attribute of the key.  However, on a FIPS
system, the MD5 fingerprint is not available, and the `null` value
breaks the dropdown.

To fix this, we use the `fingerprint_sha256` attribute instead. This
commit also puts the SHA256 fingerprint first in the HTML views to
avoid confusion.

Relates to #364562

Changelog: fixed

In FIPS mode, the minimum RSA key size is 3072 bits. A number of tests
use small key sizes for speed. Bump up the default to 3072 at the
minimum in most cases.

Relates to #364562

Max Woolf authored 2 years ago and Terri Chu committed 2 years ago

Instance administrators can no longer allow
expired SSH keys to work.

Changelog: removed
EE: true

Contributes to #355877

* When FIPS enabled, return InvalidFingerprint error for MD5
fingerprints

Changelog: changed

`Spec::Support::Helpers::KeyGeneratorHelper` was added in
857d0391 to generate RSA public key
in openssh format.
At that time we didn't have a gem in Gemfile to do so.

Later, we added `sshkey` gem that allows generating public keys.

Also, we used to have `SSHKeygen` class to generate RSA public keys
in openssh format for specs:

In gitlab-org/gitlab!77424,
gitlab-org/gitlab!78532
we started using `ssh_data` gem instead of `net-ssh`, `sshkey`,
`net-ssh`, `ed25519`, `bcrypt_pbkdf`, and `SSHKeygen`-class.

We can remove `Spec::Support::Helpers::KeyGeneratorHelper`
in favor of `ssh_data` gem too.

Related to #213259.

This MR provides support "ecdsa-sk" and "ed25519-sk" SSH keys.

In !77374,
   !77403,
   !77996,
   !77424,
   and !78532 we have done
   the work that facilitates support "ecdsa-sk" and "ed25519-sk" SSH keys.

By adding support "ecdsa-sk" and "ed25519-sk" SSH keys, we provide a new,
more secure, and easy-to-use way to strongly authenticate with Git
while preventing unintended and potentially malicious access.
For instance, if a user's private key file on their computer is stolen,
it would be useless without the user's security key.

Demo: Using "ecdsa-sk" and "ed25519-sk" SSH keys - https://www.youtube.com/watch?v=DtmZEVguN7g

Read:
- OpenSSH 8.2 release notes: https://www.openssh.com/releasenotes.html#8.2
- OpenSSH's support for U2F/FIDO security keys:
  https://github.com/openssh/openssh-portable/blob/8a0848cdd3b25c049332cd56034186b7853ae754/PROTOCOL.u2f
- https://cloud.google.com/compute/docs/tutorials/ssh-with-sk
- https://www.yubico.com/blog/github-now-supports-ssh-security-keys/
- https://github.blog/2021-05-10-security-keys-supported-ssh-git-operations/

Changelog: added

Etienne Baqué authored 4 years ago and Adam Hegyi committed 4 years ago

Added migration, updated schema.
Created Model class.

Using the sed script from
https://gitlab.com/gitlab-org/gitlab-ce/issues/59758

Revert "Merge branch 'rd-43185-revert-sanitize-extra-blank-spaces-used-when-uploading-a-ssh-key' into 'master'"

This reverts commit e607fd79.

This reverts commit a58f8c32, reversing
changes made to cd5d75c3.

[10.3] Migrate `can_push` column from `keys` to `deploy_keys_project`

See merge request gitlab/gitlabhq!2276

Douwe Maan authored 7 years ago and Stan Hu committed 7 years ago

[10.3] Migrate `can_push` column from `keys` to `deploy_keys_project`

See merge request gitlab/gitlabhq!2276

(cherry picked from commit f6ca52d3)

1f2bd3c0 Backport to 10.3

I've followed the [upgrade guide](https://github.com/thoughtbot/factory_bot/blob/4-9-0-stable/UPGRADE_FROM_FACTORY_GIRL.md

) and ran these two commands:

```
grep -e FactoryGirl **/*.rake **/*.rb -s -l | xargs sed -i "" "s|FactoryGirl|FactoryBot|"
grep -e factory_girl **/*.rake **/*.rb -s -l | xargs sed -i "" "s|factory_girl|factory_bot|"
```

Signed-off-by: Rémy Coutable <remy@rymai.me>

I've followed the [upgrade guide](https://github.com/thoughtbot/factory_bot/blob/4-9-0-stable/UPGRADE_FROM_FACTORY_GIRL.md

) and ran these two commands:

```
grep -e FactoryGirl **/*.rake **/*.rb -s -l | xargs sed -i "" "s|FactoryGirl|FactoryBot|"
grep -e factory_girl **/*.rake **/*.rb -s -l | xargs sed -i "" "s|factory_girl|factory_bot|"
```

Signed-off-by: Rémy Coutable <remy@rymai.me>

This is an amalgamation of:

* Cory Hinshaw: Initial implementation !5552
* Rémy Coutable: Updates !9350
* Nick Thomas: Resolve conflicts and add ED25519 support !13712

This is an amalgamation of:

* Cory Hinshaw: Initial implementation !5552
* Rémy Coutable: Updates !9350
* Nick Thomas: Resolve conflicts and add ED25519 support !13712

Signed-off-by: Rémy Coutable <remy@rymai.me>

* Documentation was incorrectly advertising the missing param