## Summary Roll out [the feature](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/256826) currently behind the `license_types_unknown_expression_fallback` feature flag. `license_types` merge request approval policies will fall back to the `unknown` license sentinel when a report license is a compound SPDX expression (`AND`/`OR`/`WITH`), restoring the pre-PMDB-v3 behavior for policies that allow or deny `unknown`. - DRI: @mc_rocha - Team Slack channel: `#g_srm_security_policies` > [!note] > Process and guidance live in the docs — this issue is just the commands and a place to track the rollout. > "Rolling out" means incrementally enabling the flag on GitLab.com to validate stability — it is not the same as releasing the feature, which happens when the flag is removed. > [Feature flag controls](https://docs.gitlab.com/development/feature_flags/controls/) · [Feature flag lifecycle](https://handbook.gitlab.com/handbook/product-development/how-we-work/product-development-flow/feature-flag-lifecycle/#feature-flag-lifecycle) ## What could go wrong? - This only affects `license_types`-property approval policies (not the newer `licenses` property, which already parses SPDX expressions correctly via `LicenseExpressionChecker`). - A `license_types` policy that already denies or allows a custom license name literally matching a compound expression's raw text (a workaround predating this fix) keeps working: the checker checks both the raw and the `unknown`-normalized form, not just one. - No percentage or actor-based rollout limitation beyond the standard `--actors` mechanism: it is checked per project (`Feature.enabled?(:license_types_unknown_expression_fallback, project)`). ## Rollout Run all production chatops commands in [`#production`](https://gitlab.slack.com/archives/C101F3796) and cross-post the results to `#g_srm_security_policies`. Background: [incremental rollout process](https://docs.gitlab.com/development/feature_flags/controls/#process), [feature actors](https://docs.gitlab.com/development/feature_flags/#feature-actors). **Non-production** ``` $ chatops gitlab run feature set license_types_unknown_expression_fallback 50 --actors --dev --pre --staging --staging-ref $ chatops gitlab run feature set license_types_unknown_expression_fallback true --dev --pre --staging --staging-ref ``` **Production** — percentage rollout (wait ≥15 min between steps, watch dashboards): ``` $ chatops gitlab run feature set license_types_unknown_expression_fallback <percentage> --actors ``` Or target specific actors instead: ``` $ chatops gitlab run feature set --project=gitlab-org/gitlab,gitlab-org/gitlab-foss license_types_unknown_expression_fallback true $ chatops gitlab run feature set --group=gitlab-org,gitlab-com license_types_unknown_expression_fallback true $ chatops gitlab run feature set --user=mc_rocha license_types_unknown_expression_fallback true ``` (Prefix each of the above with a leading `/` when actually typing it into Slack; it's omitted here so GitLab doesn't treat it as a quick action.) ## Before global rollout Confirm the relevant gotchas before going to 100% — see [enabling a feature for GitLab.com](https://docs.gitlab.com/development/feature_flags/controls/#enabling-a-feature-for-gitlabcom): - [Docs + version history](https://docs.gitlab.com/development/documentation/feature_flags/) updated - [Breaking changes](https://docs.gitlab.com/development/documentation/release_notes/#deprecations-removals-and-breaking-changes) announced, if any - [Change management issue](https://handbook.gitlab.com/handbook/engineering/infrastructure-platforms/change-management/#feature-flags-and-the-change-management-process) opened, if required - [External API consumers](https://docs.gitlab.com/development/feature_flags/#do-not-use-feature-flags-in-external-api-consumers) handled with a fail-open mechanism, if applicable ## Cleanup Remove the flag once [deemed stable](https://handbook.gitlab.com/handbook/product-development/how-we-work/product-development-flow/feature-flag-lifecycle/#feature-flag-lifecycle) — see [cleaning up](https://docs.gitlab.com/development/feature_flags/controls/#cleaning-up). Remove the flag and its YAML definition from the codebase, then: ``` $ chatops gitlab run release check https://gitlab.com/gitlab-org/gitlab/-/merge_requests/256826 19.5 $ chatops gitlab run feature delete license_types_unknown_expression_fallback --dev --pre --staging --staging-ref --production ``` ## Rollback ``` $ chatops gitlab run feature set license_types_unknown_expression_fallback false # production $ chatops gitlab run feature set license_types_unknown_expression_fallback false --dev --pre --staging --staging-ref # non-production $ chatops gitlab run feature delete license_types_unknown_expression_fallback --dev --pre --staging --staging-ref --production # remove entirely ``` ## References - Fixes https://gitlab.com/gitlab-com/request-for-help/-/work_items/5401 - Related to https://gitlab.com/gitlab-org/gitlab/-/merge_requests/256826