GitLab Continuous Vulnerability Scans, 5 Mar 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Development of Continuous Vulnerability Scans - Initial planning

Description

This is part of a series of videos on the development of the Continuous Vulnerability Scans. Here we present the initial planning for this project to give a quick look at hour expected due date. Please keep in mind that at this point the level of predictability is pretty low and we need to further break down these high level tasks to refine the planning.

You might want to watch the Overview first at: https://www.youtube.com/watch?v=ahl8gTkuWZ4

You can read more on the corresponding epic: https://gitlab.com/groups/gitlab-org/-/epics/7886

A

Hi, you are watching a series on continuous reality scans, and now we will be talking about the planning. So here is a planning proposal that was made uh before 15.10 started.

A

um This was made as soon as we knew uh the new ad count for uh the composition, that is, this team and basically made on the expectation that there will be something uh to deliver for 15.11 for continuous for defense, skinning and 16.0 for our container scanning. This is a line with the occur that we initially designed for this quarter, but unfortunately we already know this is something that is not very realistic, because we are two weeks in 15.10 and nothing has been started.

A

Yet this the team is still, uh he really focused on completing the work on license scanner and only a few Engineers started to jump out of that project, and it's likely that we will start this by next week, but we have basically, uh we are basically already two weeks left two weeks late. uh This is also showing the uh confidence level that is reused from the previous video, and there is no detail on the level of efforts. This is not representative.

A

uh This is just a very quick draft that we made at the time to highlight the dependency between the different tasks, but um at the time, and still today, we haven't yet uh refined or done the planning, the printing, the planning breakdown, sorry uh for those main epics, so uh it's very difficult to be predictable in planning.

A

Now, the current draft that I'm working on is a bit more representative about the ml work that needs to be achieved. As you can see, we are now expecting to push things down to 16.0 for dependency scanning and 16.11 uh 16.1, sorry for uh container scanning.

A

um What we really want to start uh by next week, working on is uh the proof of concept.

A

um This will tell us where we want to do uh the matching logic and basically, the two choice we have is to either move that into the raised application or to leverage the brand new infrastructure that we spend up for the license scanner, the new license scanner.

A

So uh we have to wait for that proof of concept to be completed before weekends really start working on storing advisories for the pencil scanning advisories for container scanning and the matching Logic for the pencil scanning. Also, uh you can quickly see there the sequential aspect about having things done. First, in the pencil scanning before they can be started in container scanning.

A

As we go through the breakdown, we will be able to subdivide that and to optimize the starting date for a few of those parts, but so far this is a more confederative approach on the planning that highlights this level of dependency.

A

um The other part that we want to start right ahead in 15.10 in is a vs bomb work. uh There is uh very little things left to be done in the pencil scanning, but there might be some database changes. So that's why again I'm more conservative and and put that into the beginning of 15.11 for completion, because we know that database review usually takes more time and it's not 100 sure that we will be achieving that in the next two weeks on the same page for continuous scanning.

A

Because again there is one part in the CI job that we're fairly confident in shipping. But storing things in the database might require additional changes to the schema and same things. It might take more time to be reviewed and emerged in the main project.

A

um The other part that we have already completed actually Mike Edington, uh already completed that uh Spike for uh the advisories, and this is a very interesting work. We are not yet sure if we will be able to uh reverse that immediately for the MVC, if it will be more for the longer term, um someone will have to take over the work for uh in our group and figure that out.

A

It might also be EVD influenced by the result of the proof of concept, because if we do things in the very small list, it's less likely that we can leverage this new stack because they're a very brand new technical component that might not fit into the usual deployment of our Omnibus project. But if we have the opportunity to do that rather into the new infrastructure that we develop for the new license scanner, we will have more flexibility into using new components. So um again, there is no much more that we know today.

A

We have to leave the team working through the planning, breakdown and refining um those epics, so that we have a better idea about what needs to be done for those big parts and when we can further optimize the start date um also, uh we haven't yet identified a quicker path, a more iterative path to demonstrate and ship something to the users as uh before the end of the old project. This is something I also highlighted in the previous video, but we will try to challenge the team.

A

If you have any suggestions feel free to suggest them to us. They are very welcome. So, hopefully, by next uh in the next two weeks, when I'll be back from ptos I will be able to share more about this planning and stay tuned. If you want to know more about when we expect to achieve that, thank you for watching and see you soon.