GitLab GitLab 13.1 Release Product Kickoff, 17 May 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: GitLab 13.1 Kickoff - Secure: Static Analysis

Description

GitLab Secure: Static Analysis Group Product Manager, Taylor McCaslin, provides an Overview of 13.1 release plans.

Content from the video:
- 13.1 Planning Issue: https://gitlab.com/gitlab-org/secure/general/-/issues/88
- SAST To Complete Epic - https://gitlab.com/groups/gitlab-org/-/epics/527
- Secret Detection Documentation: https://docs.gitlab.com/ee/user/application_security/secret_detection/
- About GitLab's Static Team: https://about.gitlab.com/handbook/product/categories/#secure-stage

Issues we'd love your feedback on:
- Addition Runner OS support for .NET SAST - https://gitlab.com/gitlab-org/gitlab/-/issues/218097
- UX Exploration for SAST Configuration UI - https://gitlab.com/gitlab-org/gitlab/-/issues/216635

A

Hi everyone, my name, is taylor, mccaslin and I'm the product manager for the static analysis group within the secure stage. Today, I'm going to give you an overview of what we're planning for 13.1 so to get us started. This release we're beginning to use planning issues so hopefully you'll find these useful I'll link. This in the video description below you'll see that the static analysis group is focused on three different areas: we've got sas, which is static, application security, testing, secret detection and, in the future, we'll be working on malware scanning.

A

So for 13.1 we have a few themes that I want to review for you our first one is to simplify and clean up. We know we have a large number of scanners today. We've got about 15 of them that we manage actively with this group and there's a lot of updates that we need to do some bug fixes associated with them all to improve the quality of our scanning, we're having that be a core focus for us in 13.0 and 13.1.

A

So we'll continue that next we've got secret detection to viable. So in 13.0 we saw a lot of improvements with secret detection, we're excited about these developments and we believe that we've now brought that maturity to viable. So we'll discuss that here in just a few minutes. Next, we want to work on a configuration ui with all of our scanners.

A

There's lots of different configuration options and we want to make it easier for you to understand those configuration options and to be able to manage and maintain them over time, so we'll be exploring exposing a new configuration object, we'll be focused primarily on designing that in 13.1, but we may begin building that as well and then I'll also call out that we're beginning a new community rotation program in 13.1.

A

So basically, what this means is that we'll have a dedicated engineer from this static group who will be focused on community contributions, handling customer escalations and bugs and beginning our migration for some of our sas scanners to our core, offering. We hope that this will improve the time between you submitting community contributions, which we very much appreciate and encourage you to continue doing and getting those prioritized that they actually make it into release.

A

So we hope that'll be a nice improvement for any of you contributing to get lab. And again we want to thank you for all of the work that you're doing so that's an overview of the themes that we're focused on for 13.1. There are a few things that I want to highlight for you so to begin. We have spent a lot of time defining our to complete epic for sas. This is a core focus for us as a company, so there is a lot of information here.

A

I would love for you to take a look at this epic, provide comments on any issues or things that you might want to see from our static application security scanners. This is our number one priority for this group for the foreseeable future, as we continue to push to complete for our static scanners in fish in this year.

A

Next, I want to review our maturity. So, as I mentioned before, this is a primary focus for us in this current year to mature sas to complete, we plan to have that done within the next year, effectively looking towards the beginning of 2021.

A

But what I want to call out for you is that we are to the point where we are ready to mature our secret detection from minimal to viable, so we'll be doing a lot of uh documentation updates within 13.1 to help transition secret detection.

A

One of those things that I'll call for you is that we have created a new secret detection, documentation page. This is complete with a lot more details than we support today in our documentation, so know that this is here, and we hope that you find this helpful next. I want to talk about support4.net framework with 13.0 we released.net framework, which we're very excited about for this release, we're going to focus on expanding support outside of docker. So today our net framework support requires a linux runner.

A

We want to expand that to support other os's for our runners. So if you have comments about what you'd like to see for that I'd love for you to comment on this issue to help us with our direction next, I want to call out that ux discovery issue for our configuration ui. We would love any thoughts on the wireframes and designs that are attached here and that wraps up our focus for 13.1 for our secure static analysis group, we look forward to another great release.