Skip to content

Revert Dependency Proxy permission

Steve Abrams requested to merge fix-dependency-proxy-revisions into master

What does this MR do?

In #280586 (closed) we updated the :read_dependency_proxy permission to requiring Reporter access. This was not well communicated and has caused disruptions for some users of the Dependency Proxy feature. We are going to lower the permission to Guest to help resolve those problems.

Screenshots or Screencasts (strongly suggested)

How to setup and validate locally (strongly suggested)

  1. Set up your GDK with the Dependency Proxy

  2. Create a group, add a user to the group as a Guest

  3. Log in to the dependency proxy with this user using a personal access token or your credentials

    docker login gdk.test:3001
  4. Pull an image through the Dependency Proxy for that group

    docker pull gdk.test:3001/groups/<full-group-path>/dependency_proxy/containers/alpine:latest
  5. The image should be pulled successfully

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

Does this MR contain changes to processing or storing of credentials or tokens, authorization and authentication methods or other items described in the security review guidelines? If not, then delete this Security section.

  • [-] Label as security and @ mention @gitlab-com/gl-security/appsec
  • [-] The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • [-] Security reports checked/validated by a reviewer from the AppSec team

Related: #337825 (closed)

Edited by Steve Abrams

Merge request reports