Skip to content

Include improvements suggested by @xlgmokha

Philippe Lafoucrière requested to merge improve-secure-binaries-tmpl into master

What does this MR do?

This MR addresses some new comments on !28566 (merged) and fix a few things:

  • We don't save a tar temporary file anymore, we pipe directly the output of docker to gzip now.
  • We don't force SECURE_BINARIES_SAVE_ARTIFACTS to false for spotbugs and licence-management anymore. This setting is now false by default anyway. The 1GB artifact limit is only on GitLab.com anyway and will differ on self-hosted instances.
  • license-management was recently renamed to license-scanning, and we follow this new convention. For backward compatibility, the job will still be triggered if SECURE_BINARIES_ANALYZERS contains license-management.

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • [-] Label as security and @ mention @gitlab-com/gl-security/appsec
  • [-] The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • [-] Security reports checked/validated by a reviewer from the AppSec team
Edited by Philippe Lafoucrière

Merge request reports