Record an audit event when a GPG key is updated

José M. Requena Plensrequested to merge
gitlab-community/gitlab-org/gitlab:jmrp-gpg-key-update-audit-event into master

What does this MR do and why?

This MR builds on !265240 and merges after it. Until then it also carries that MR's commit, so the change to review is the last commit.

This MR records the update of a GPG key as the update_gpg_key audit event, as EE::GpgKeys::CreateService records add_gpg_key. Its details hold the key's fingerprint and the fingerprints of the subkeys the update added, and no key text or email address. Nothing is recorded when the update adds nothing or is refused.

  • EE::Repositories::GpgKeys::UpdateService extends the service, which now ends with prepend_mod.
  • ee/config/audit_events/types/update_gpg_key.yml, and its generated row in doc/user/compliance/audit_event_types.md.
  • The commit carries EE: true, since the event exists only in EE.
How I tested it

Ruby 3.3.11 and PostgreSQL 17, without the GDK:

  • bundle exec rspec ee/spec/services/ee/repositories/gpg_keys/update_service_spec.rb spec/services/repositories/gpg_keys/update_service_spec.rb: 30 examples, 0 failures.
  • FOSS_ONLY=1 bundle exec rspec spec/services/repositories/gpg_keys/update_service_spec.rb: 26 examples, 0 failures.
  • bundle exec rake gitlab:audit_event_types:check_docs: up to date.
  • RuboCop and markdownlint-cli2 on the changed files: clean.

Without the EE module, the example that records the event fails.

References

Related to #296977

  • Builds on !265240.
  • Milestone: 19.6, as in the event type definition. I cannot set it myself.

Screenshots or screen recordings

No UI change beyond the new row in the audit events list.

How to set up and validate locally

  1. On a licensed instance, update a GPG key with a new subkey, as in the steps of !265240.
  2. Admin area > Monitoring > Audit events shows "Updated GPG key", with the key's fingerprint and the new subkey's in its details.
  3. Add the same export again. No new audit event is recorded.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Merge request reports