►
A
A
A
This
is
the
issue
here
that
I'm
tracking
kind
of
all
the
tasks
that
are
associated
with
getting
this
first
version
of
secure
files
released
to
gitlab.com
in
case
to
set
some
context.
I
guess
the
secure
files
feature
is
a
feature
that
we've
built
into
gitlab
that
allows
for
the
upload
of
binary
files
to
to
be
used
as
kind
of
ci
variables.
A
A
The
the
infrastructure
is
still
in
progress,
so
we're
getting
that
there,
hopefully
we'll
be
able
to
test
this
on
staging
pretty
soon,
but
we
did
go
through
an
appsec
review
of
the
api
and
had
some
good
feedback.
Everything
looks
good
though,
but
there's
some
a
couple:
follow-up
tasks
that
that
I
picked
up
from
that
and
let's
see
the
other
other
changes.
A
That
kind
of
went
in
this
week
are
a
change
to
clean
up
clean
up,
secure
files
when
when
projects
are
destroyed,
so
this
was
just
just
kind
of
a
cleanup
task
that
we
needed
to
do
and
then
the
let's
see,
oh
there's,
adding
some
limits
so
kind
of
a
limit
to
the
number
of
files
that
can
be
uploaded
to
a
project.
We're
doing
this
to
prevent
any
kind
of
abuse
that
might
happen
to
the
api.
A
So
right
now,
projects
are
just
limited
to
100
files
and
we'll
we'll
roll
that
out
and
then
see
see
kind
of
what
the
right
calibration
is
for
that
down
the
road
and
then
the
the
last
feature
here
that
I
wanted
to
chat
about
is
adding
a
checksum
to
the
uploaded
file
that
can
be
used
to
verify.
The
file
that
was
received
is
correct,
so
this
this
was
actually
some
feedback
that
came
out
of
the
appsec
review,
which
I
thought
was
a
really
a
really
nice
addition
to
the
feature.
A
So
basically,
what
this
will
do
is
when
you're
uploading
a
file
to
secure
files.
You
can
provide
a
256
check
sum
of
that
file
along
with
the
payload
and
then
when
we
go
to
process
that,
on
our
back
end,
we'll
check
that
to
make
sure
that
everything
verifies
correctly.
So
that
would
prevent
any
sort
of
interception
attacks
or
anything
like
that.
So
and
then,
if
that
value
isn't
provided,
then
we
just
don't
check
it.
So
it's
an
optional
feature,
but
a
nice
additional
security
check
there.
A
A
But
essentially
what
fastlane
is
is
a
it's
a
open
source
tool
chain
for
mobile
developer
mobile
developers
to
make
the
whole
process
of
building
mobile,
apps
kind
of
easier
and
more
repeatable
and-
and
it
is,
is
a
nice
tool
to
integrate
with
ci
systems,
and
so
one
of
the
components
of
that
is
a
tool
called
match.
And
what
what
match
does
is
it?
A
But
you
can
use
git,
you
can
use
google
cloud,
you
can
use
aws
and
then
what
I'm
working
on
is
a
gitlab
secure
files
back-end
for
this,
and
so
when
you
write
your
match
file,
I've
got
an
example
here.
Basically,
you
set
your
storage
mode
and
your
gitlab
project,
and
then
the
type
is
either
like
development
or
app
store,
like
whichever
type
of
certificates
you're
building
locally.
A
A
A
I've
been
building
locally
and
I've
configured
fastlane
to
talk
to
my
local
get
lab
instance,
and
I've
got
my
project
here
with
there's
no
secure
files
right
now,
and
then
I've
also
got
the
tab
open
here
into
my
apple
developer
portal,
which
shows
that
now
the
certificates
have
been
generated.
Yet
what
I'm
going
to
do
over
here
in
my
terminal
is
I'm
just
going
to
run
bundle?
A
Fastlane
match
and
what
this
command
will
do
is
it
will
look
at
the
project.
It
will
look
at
gitlab
and
it
will
look
at
the
apple
developer
portal
and
see
that
we
don't
have
any
certificates
generated
and
it
will
go
and
generate
the
whole
thing
for
us
and
upload
it.
So
this
will
take
just
a
little
bit
to
run
and
it
has
a
bunch
of
output
along
the
way.
But
it's
basically
saying
what
it's
going
to
do
here
and
kind
of
how
it's
configured.
A
And
there
we
go
and
it
does
have
like
I
have
logged
into
the
developer
portal
through
fastline,
so
it
has
my
like
login
saved.
If
I
hadn't
been
logged
in
it
would
prompt
me
for
my,
like
account
and
password
all
right
cool.
So
I
think
that
is
done.
So
it
says
all
keys
certificates
and
provision
profiles
are
installed.
A
A
A
And
then,
if
we
go
back
in
here,
we'll
see
another
provisioning
profile
for
the
app
store,
as
well
as
the
the
distribution
certificate
here,
and
then
we've
got
these
files.
That
will
also
show
up
in
here
there
we
go,
so
we've
got
the
distribution
certificate,
the
private
key
and
the
provisioning
profile.
A
So
there's
there
isn't
any
type
of
association
yet
for
that
that,
like
those
type
of
relationships
really
like
what
the
way
the
secure
files
acts
right
now
is
just
kind
of
a
that's
like
a
small
repository
and
they
can
be
used
through
kind
of
whatever
ci
configuration.
You
want
to
run
to
pull
into
the
different
environments
so,
like
I
guess
the
example
would
be.
If
you
were.
A
If
you
wanted
to
use
these
with
fastlane,
for
example,
you
would
you
would
tell
fastlane
which,
which
type
of
certificates
to
use
for
the
build
that
you're
trying
to
run.
So,
if
I
were,
I
don't
have
a
good
example
of
this,
but
if
I
were
building
like
a
ci
script
to
use
these
secure
files,
my
one
of
my
steps
would
be
something
like
vaseline
match.
A
A
B
A
If
you
weren't
using
fastlane,
what
you
would
probably
do
is-
and
this
is
still
kind
of
a
work
in
progress-
you
would
you'd
probably
pull
down
like
all
your
secure
files
into
a
folder
in
your
ci
job
and
then
select.
You
know
like
configure
your
ci
job
to
use
the
ones
for
the
different
environment
that
you
would
have
you
got
it,
but
yeah
like.
I
could
see
future
iterations
of
that
having
some
sort
of
association
there
yeah.
B
A
A
kind
of
temporary
solution
for
this
we'll
call
it
a
first
iteration,
but
what
this?
The
way
that
this
is
set
up
today
is
there's
this
little
ruby
script
that
you
can
set
up
in
your
ci
job.
Using
this
this
one
liner
here
and
what
this
does
is
it
basically
goes
out
to
get
lab
grabs
all
the
secure
files
and
then
pulls
them
into
your
your
runner
instance
yeah,
and
so
there's
no
there's
no
special
hooks
into
runner.
B
A
Yeah
yeah
and
that
that
was
that
was
sort
of
the
idea.
Sort
of
the
generalized
approach
solves
the
problem
for
mobile,
but
then
could
be
used
for
many
other
the
context
and
and
really
the
idea
behind
the
sort
of
mvc
release
of
this
is
like:
let's,
let's
get
it
out
there
and
get
some
feedback
from
people
and
get
like
feedback
just
like
that,
like
you're
describing
like
how
do
we
associate
these
two
environments
or
or
like?
How
do
we
protect
these
in
different
ways?
B
A
Yeah,
so
the
the
first
iteration
of
this
was
really
just
an
api
interface,
and
so
there
is
in
this
issue
here
there
is
a
section
on
the
docs,
so
I
added
this
the
api
docs
here.
So
there
is
a
full.
You
know
sort
of
write
up
on
how
to
interact
with
secure
files
today,
and
that's
mostly
done
through
the
api.
A
This
view,
right
here
is,
is
just
a
single
like
read-only
view
that
I
I
created
just
to
have
something
to
start
with
this
isn't
really
intended
for
for,
like
a
broad
release,
I
think
before
we
would
release
this
ui.
I
would
want
to
have
the
ability
to
at
least
upload
files
directly
here
and
then,
like
you
know,
maybe
delete,
maybe
not.
B
A
It's
not
hooked
into
the
navigation
right
now,
either.
Okay,
so
it's
it's,
like
you
know,
sort
of
feature
flagged
off
in
that
way,
because
it's
just
sort
of
hidden
but
but
yeah.
I
think
this
would
like
the
in
the
sketches
that
I
had
it
was.
It
was
maybe,
I
think,
under
ci
cd,
like
adding
a
new
tab
in
here
for
secure
files.
A
Yeah,
I
think
I
think
putting
it
in
here
would
would
would
really
kind
of
scope
the
context
a
little
bit
so
like.
Oh
these,
these
are
for
ci
cd
they're,
not
secure
files
for
package
registries
or
or
security
scanners,
or
other
things
like
that
right,
like
maybe
they
could
be
used
that
way
but
like
this
is
what
they're
intended
for
so
yeah.
A
So
what
what
what
I'm
intending
to
do
with
this
is
to
actually
like
right
now.
We
don't
have
a
validation
for
this,
but
I'm
going
to
add
it.
So
files
have
to
have
a
unique
name,
and
if
you
try
to
upload
a
file
with
the
same
name,
it
will
give
you
an
error.
So
if
you,
if
you
try
to
upload
readmemd
again,
it
would
reject
it.
So
we
already
have
a
file
in
this
project
with
that
name:
okay,
either
either
delete
that
file
or
change
the
name.
A
A
I'm
the
the
fastlane
integration
is
a
work
in
progress,
but
I'm
hoping
to
have
a
pull
request
into
the
fastline
project
coming
up
this
week
and
start
working
through
the
the
process
of
getting
that
change
merged
in
and
then
the
upload
checksums.
I'm
also
working
on
that
and
I've
got
an
mrn
progress
for
that.
So
that
is
what
we've
got
for
this
week.