GitLab Compliance Group - Meetings, 10 Jul 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: GitLab 13.3 Kickoff - Manage:Compliance

Description

- Refer only to project "delete" (not project "remove"): https://gitlab.com/gitlab-org/gitlab/-/issues/221100
- Allow admins to revoke PAT tokens via API: https://gitlab.com/gitlab-org/gitlab/-/issues/216004
- Add source and destination branch data to Compliance Dashboard: https://gitlab.com/gitlab-org/gitlab/-/issues/216279
- Add additional PAT expiration notification job: https://gitlab.com/gitlab-org/gitlab/-/issues/214721
- "Remove Project" should also ask for the namespace during confirmation: https://gitlab.com/gitlab-org/gitlab/-/issues/24401
- Follow-up: Refactor controller to make code clearer and remove unused variables: https://gitlab.com/gitlab-org/gitlab/-/issues/220523
- Drop updated_at column on audit_events: https://gitlab.com/gitlab-org/gitlab/-/issues/217941
- MVC: Chain of custody report, list of commits: https://gitlab.com/gitlab-org/gitlab/-/issues/213364

A

Hey everyone: my name is Matt Gonzalez I'm, the senior p.m. here at get lab for the compliance group and I excited today. To talk to you a little bit about our plan for 13.3.

A

Most of the work will be focused on is internal improvements, improving things like the project deletion, experience for users and also continuing the art of events. Refactor work that'll help us build more art of event, related features in a more performant way and faster, hopefully with less technical complexity. But there's a couple of features: I'm excited to talk to you about in particular, and those in our around personal access, token credential management as part of a larger effort to improve the experience of credential management for both administrators and owners and their users.

A

There's a few changes that we need to make. One of those is making sure that admins have an ability to revoke a user's personal access token, where policy exists, that users are required to rotate these credentials. It's helpful if admins have the ability to be able to enforce that in some way without making it a default. Disruptive experience at gitlab.

A

Another requirement to that is ensuring that you are able to list the personal access token credentials for your users so being able to list them, and then optionally revoke them as a capability that we'll be adding in this milestone. We're also looking at adding an additional notification job for the expiration of personal access tokens so that currently a user will be informed seven days prior to the expiration. But then, after that, it's sort of out into the ether.

A

No there's no real indication that something is wrong, prompting the user to then take action, so we'll be adding an additional notification here that should help communicate to users when they're out of compliance with a particular policy and hopefully avoid the need for admins to intervene with a more forceful action will also be doing another iteration on the compliance dashboard to add source and target branch data to provide a more holistic view of each merge request per prod.

A

This should help fill out and close the loop on some of the key highlights that you have shared with us as important to your day-to-day decision-making and allow you to comb through.

A

All of that, in a singular place on the compliance dashboard and negating the need to dig into each individual project and lastly, the one I'm most excited about is one of our first iterations on a Chain of Custody report, we'll be starting with a list of all of the commits for a particular date range and from here we'll extend that out to include other data such as related merger, quests, pipeline IDs, maybe job statuses and ID's. But the idea here is it's to get a baseline or a foundation started and build upon that.

A

This should help surface a highly demanded request or feature that we've been asked for for a while. Now that enables our customers to more easily generate reports for their auditors, internal or external, and just provide much better visibility into each release, so I hope you're as excited as I am to see some of these features manifest and, as always, people please feel free to comment on this video or get in touch on any of these issues to comment and participate in the direction of these features and others like it and your all.

A

We also have a special interest group, where you're welcome to join if you'd like to participate further thanks. So much for listening.