LF upgrade from Debian Buster to Debian Bullseye

changed milestone to %14.6

added Category:License Compliance [DEPRECATED] groupcomposition analysis workflowplanning breakdown labels

added backend label

mentioned in issue gitlab-org/secure/general#177 (closed)

Setting label(s) devopssecure sectionsec based on groupcomposition analysis.

@brytannia AFAIR you already started working on that but had some issues. Could you please confirm and detail the problem you've encountered? Thanks

@gonzoyumo i also remember there being some issues, and since it's LF i'm going to bump out as IMO it can wait if it's complicated, since we're going to be ditching it soon fingers crossed

@NicoleSchwartz @gonzoyumo here is a closed MR for this bump gitlab-org/security-products/analyzers/license-finder!72 (closed) Some integration tests fail and it's a blocker. Debugging this issue is complicated. So if this update could wait, I'd wait.

@brytannia we'll revisit in a few by then we should know if this is going away for 15.0 or not and can make our assessment with better future timing considerations

Thanks @brytannia for the context.

@NicoleSchwartz my main concern is that this is likely to block several security issues (12 blocked for LC out of 16 total blocked). Though, these are mostly P3 that are already overdue

@gonzoyumo yeah they were all already overdue but p3 so i wasn't too worried

@ngeorge1 can we wait until 14.8 to timebox looking at this problem again, the p3 will continue to not be solved for license finder but it's all container OS issues

Looks ok to me.

I took this issue because this creates a problem in resolving the following CVE: https://gitlab.com/gitlab-org/gitlab/-/issues/353604#note_917310282

In short: debian:buster uses ruby 2.5 but in order to upgrade a vulnerable dependency we need to bump a package that has a constraint on using a newer ruby: https://github.com/chef/omnibus/blob/main/omnibus.gemspec#L15

@ifrenkel is the upgrade is in our wrapping / container and not something we need to worry about impacting LF itself?

@NicoleSchwartz tbh I don't know yet. I've tried a few methods of resolving this and it looks like the updating the debian version in the build container has the same order of complexity as the main container. I'm now trying to either bump ruby or find a way to bump the dependency in question manually.