c/c++ conan offline license compliance

Problem to solve

Detect software licenses associated with dependencies declared using conan the same way we do today for online instances, in an offline instance relying on a proxied or locally hosted custom repository.

If possible this will deal with setting both address and optional authentication. If needed pop authentication into it's own issue.

Intended users

• Sasha (Software Developer)
• Devon (DevOps Engineer)
• Sidney (Systems Administrator)

Personas are described at https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/

Further details

This change allows the retrieval of pip dependencies from non standard sources.

This is to support users in offline GitLab self-hosted instances

Proposal

Permissions and Security

same users today who can setup license scanning can set it up.

the repository may or may not be authenticated

Documentation

We will need to update user documentation

Availability & Testing

Manual: Use the existing GCP environment

Automated: Please work with Quality to make sure we have coverage as we must avoid regression

Testing to be included as per #219461 (closed)

What does success look like, and how can we measure that?

after following documentation it does not require an internet connection to run a scan and provide results.

What is the type of buyer?

Heavily regulated industry, highly secretive organizations, and those with poor connectivity.

Is this a cross-stage feature?

no

Implementation Plan

• Set up a custom conan registry in the Offline test environment. Documentation
• Research: Find out if it's possible to specify and/or exclude development/test dependencies from the scan output.
• Add integration test(s) to fetch dependencies from a conan registry.
• Add integrations test(s) to verify that dependencies can be installed from a conan registry served with a custom self signed TLS certificate that is not in the default root certificate authority trust store.
• Add documentation to describe any special setup or configuration required for fetching dependencies from a custom conan registry. Example !33444 (merged)
• Add documentation to describe any setup required for working in an offline environment. Example !33444 (merged)
• Add example project to templates for a specific platform. E.g. conan-debian, conan-windows

Links / references