Feature flag rollout: dependency_firewall_malicious_packages

Summary

Rollout of the dependency_firewall_malicious_packages feature flag, which gates the malicious package signal in Dependency Firewall (DFW) enforcement: the PackageMetadata::MalwareAdvisoriesFinder query and the Security::DependencyFirewall::FetchPackageMaliciousService path that block/warn on flagged packages at package download/upload time.

Part of epic &22692 – Malicious advisories finder for Dependency Firewall enforcement.

Flag details
Name dependency_firewall_malicious_packages
Type development (gradual rollout)
Default state disabled
Actor instance-wide (Feature.enabled?(:dependency_firewall_malicious_packages, :instance) — the finder has no per-project actor)
Group group::dependency firewall

The malicious signal is gated separately from dependency_firewall_phase1 so it can be enabled independently of the existing license/vulnerability signals.

What the flag controls

The flag is a query kill-switch checked inside PackageMetadata::MalwareAdvisoriesFinder#execute. When disabled (default), the finder short-circuits and returns [] before running any DB query, so no package is flagged and DFW behaviour is unchanged. When enabled, the finder runs its (purl_type, package_name) lookup and version match, and any malicious DFW rule is evaluated against the results.

This lets the query be enabled for performance testing and disabled immediately if it causes production performance issues. Introduced (definition + gate) in !244115.

Rollout steps

  • Enable in a local/dev environment and confirm a flagged package is blocked/warned per the policy.
  • Enable on staging (/chatops run feature set dependency_firewall_malicious_packages true --staging).
  • Enable for the gitlab-org group on production.
  • Gradually roll out on production (--random 25 → 50 → 100, or per-project actors).
  • Enable globally on production.
  • Remove the feature flag and default the behaviour on (follow-up MR).

Rollback

Disable the flag: /chatops run feature set dependency_firewall_malicious_packages false. This restores the pre-rollout behaviour (FetchPackageMaliciousService returns []); no data migration is involved, so rollback is instantaneous and safe.

References

Edited by 🤖 GitLab Bot 🤖