GitLab Secure Stage, 25 Mar 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: License Compliance Air Gap Live Demo 2020 03 25

Description

No description was provided for this meeting.
If this is YOUR meeting, an easy way to fix this is to add a description to your video, wherever mtngs.io found it (probably YouTube).

A

All right, thank you, everybody for joining in today. This is the live demo for the limited connectivity or air-gapped work that we are doing for license. Compliance today is March 25th, 2020 and Olivier. Please take it away.

B

Thanks dad so here's a scar cat that will try to complete this demo. Obviously the setup is the same as the one from success demo. So I will just quickly run through the explanation. We are leveraging two instances liam's the first one is guitar packet test, which is asking the key types of management stones and well so leverage the best in house to do some intermediate connectivity, stuff and checks data into the agate instance.

B

This is a seconds diagram that quickly explained how we are doing this so from a local machine. I'm logging in to the bastion host yeah SSH and from there I can read the killcam registry to code, some scanner images save them into tau fire. That I can then copy over SCP to the air-gap instance, where we can load them back into the registry and make them available to the CI jobs. The top number 5 is what we might vary depending on your environment set up and your political ah into the air gap instance.

B

So the first thing I will do is just showing up that I am connecting to the instance yeah HTTP, which is one of the port, that out loud from the internet, and this is using this specific house name because I added that to my local machine ETCs file, otherwise I would not choose to use that an IP address to get to it.

B

You can also see here that I have some predefined command to connect jssh to the bastion host here and here to the gap test instance.

B

All right so as explained in this quick seconds diagram to get his license scanner into the air-gap instance. I first need to download them hold it from the the bastion asked I'm using this really quick script, which is just specifying which image which image I want to download. It's pulling it here, saving it into a file which is not here stored on the file system, but instead because it's too big abide in the image was a great tip to just gzip it and stream.

B

It directly to the I get asked which is specified with this IP address here and loaded directly sex mode for that quick tip. So I will just run that and since it's two gigabytes it might take a while. So in the meantime, let's move forward and go to the agate test instance, where I want to make sure that I don't already this license image available.

B

So by doing this, I'm, basically asking the cremate the ker to tell me the list of images they have. Luckily we have the license in the name we can see. We have one image vehicle license management with the latest tag. We want just that one or it's fine and I can also show you directly the gate level UI, where this image will be intimately uploaded so that it will be used by the CI job.

B

So here we can see this latest AG available here, but we still don't have the 12.8, which is still being compiled right now.

B

So what is running? Let's have a look at a test project that has been set up on this test instance. As you can see, there is no velocity, IMF ISO and nothing has been configured yet. This is a sample java project that contains some dependencies. Some of them have been counted out just for the purpose of that demo, and if you look at the license list here, you will see that there is nothing available, so so first step will be to set up that and I will just for the purpose of the demonstration use.

B

The configuration highlighted into our documentation for the usual use age, which is not the igap one, so are the first step. I will just open the web IDE and.

B

Add a new get up CI mo file here, pasting those two lines and singing this I can cook it that directly to master which is not really great, but again just for the demo. This should trigger pipeline that I can see soon here.

B

Yes, so, as you can see, the license canning job has now been configured there and, as you can see, it's trying to reach out to the registry and get Capcom which might fail in a few seconds.

B

All right, so you can see it is a timing, oil, it's really trying multiple time, but ultimately this will fail.

B

So this is still being copy out here. I feel any questions feel free to ask them why this is happening.

B

And obviously the license compliance page is still not available. So.

B

We don't have any documentation available yet for license compliance, because your work is still ongoing. I can quickly show you the documentation that has been added for general air gap, support which provides some of the example script. That I was mentioning, and we also have some directly available documentation for.

B

Some our projects, but we don't have it yet for license compliance again. This is still ongoing. I have this small snippet here that contains what needs to be done for license compliance, so I can do, is quickly copy pad that and absorb and implement that change into that project.

B

Here so basically, here we are still loading the license: caning image, the license, cutting jobs, sorry that we are overriding it to specify that the image we want to use is this one. So it's currently leveraging the latest work, but we will all read that, because this is nothing one we want to use, then we have some having CLE options that are being read in here like we want to be in a flight mode. We want to specify a given settings.xml file.

B

We are enabling some debit logging for the license plug-in, which is an delaying tool which is extracting the licenses from the mainland dependencies and then some workaround to avoid SSL check happening, because we still have not support for the custom certificates, which is a non-issue and something we will address soon, and then we are writing the C type CMD command, which is avoiding some other remote checks during this setup.

B

Obviously this is work in progress and this will be well documented and we might be fine we're looking for a better way to provide this and and set up the a gap environment. Now here we have a very simple job, which is testing that we are still not available to reach all of the internet from the CI job. So this is just doing.

B

Do we get to the register.com and the job will success if this command is failing all right, so we now are finished to copy the 1208 stable image over to Z, so the test aster. We should see it now. Yeah. We see it here, so this is not tagged correctly. So I just first need to retag that we have an image name that matches this instance and then I can push it. As you can see, I've just used a custom tag name here, and we should see that now appearing here here.

B

It is so I'm just cooking this one and putting this here, because this is the image I want to use.

B

Alright, so from there I can commit I will use a branch.

B

I'm, creating a merge request this time.

B

Just creating that Mirage requests and we should not have a pipeline running on that branch.

B

Obviously, Arena will pick that up soon.

B

Okay as well, we can see from the previous job. It ended up, failing because I've not been able to reach out to register the key tablet car. So this is good.

B

And I don't have any trainer, so this might be a theater, but not one I was thinking about.

C

B

I'm not flagged as an that meeting with this, so I cannot look at the rather blotter.

C

Anybody else also logged in to the instance that might be able to check as admin if there's runners available.

B

The job was burning just before so maybe guys just someone else playing the instance high off notes. That's.

B

All right I can try to log either it's I.

D

See it Olivier it's running another job right now: okay,.

B

Thanks so you will have the.

D

Others, just our backstory, we have one running running running on this instance: that's being shared across all projects, hence the delay I'm gonna see if I can cancel that job. For now,.

E

Okay, can I ask a question while we're waiting, yep um so I'll just curious. What's the difference between the two images? Obviously you brought over the image. What I'm just curious look, what changes did we have to make in the image I understand all the rest of the CI changes that were necessary, I just curious, what the differences were in the in the image that you pulled over so.

B

Basically we're currently following a XY stable scheme for naming the image tags, which is following the XY major and minor number version of kik type instance. So this is running gitlab 12.8, so to have the optimum compatibility and loading the 12 page table docker image.

B

This is something we're trying to get rid of and move to, 17 versioning instead, so ultimately for the users, it will just be a matter of fetching license management, the column two or three: they couldn't even pin to a specific mine or tag if they want to it will give them more flexibility. So this is something we are currently addressing into 2010 try to change that skim, but basically it can pull whatever you want and use whatever tag. You want.

B

It's just a matter of making sure that you're using the scanner that is compatible with the instance you're running. We try to stay backward compatible as much as possible, but it might be best to follow okay, so my license canning job has been cancelled here, so I will need to retry it somebody's playing with that we have a magician.

B

Thank you more for and looking that. So let's have a look at this: let's check again job. So it's a super one unloading DLP as an image and just doing a double you get. What's it at succeeding, I mean the the camera will fail. So job not succeed.

B

All right, so it kind of connects us.

C

One of the rare trances that failure is positive.

B

Yeah we want this one to fail.

D

Add on to what Olivier settings there's no difference between the image that we have for public cloud in the private cloud and sorry, not the air-gap image, it's just a different name, so it pulls from a different location. But.

E

Yeah, that's really really going for.

D

E

We just made the changes to the mo and use the old. Imagining like the thing that would have been different would been that you might have used in have the latest image or the image that was um congruent with the get live version. Yeah.

C

It would have been an older copy of data and older copy is everything.

B

Whatever we're putting into the configuration and how we are providing this I get customer, this line would definitely be something they will have to provide whether it will be beyond environment viable. So they don't have to have a right, the job itself, to make this easier. They will still be responsible for this, but because this is really specific to their own environment, all right, so the scanning job is running now. Whilst it's running I would just want to highlight something, also very specific to license scanning, and probably the Pennsy scanning is.

B

We are injecting our scanner images within the egg instance so that we can scan the dependencies, but obviously to scan them depending on the language of the package manager we might need to access dependencies available to the assumption is that, as you are building your project within the I get instance, you already have set up everything, that's necessary to provide those dependencies to get lab CI job. When it's building the project for the purpose of this demo, we would have required, for example, a maven registry.

B

This is something that ships will get lab, so we are doing some testing to purge some custom packages to the minion registry, bundled with it the Keith Lemon's chance and this works, but I want to talk one more dependencies to show this demo I just go. We have another approach which is about bundling the dependencies, so here we have empty repository directory within the git repository.

B

So when we are running maven we are explicit is telling it that it has to use this m2 / repository directory to find other dependencies and I that they have already been added there automatically. When we are running the jobs. Maven is not trying to reach out to any remote repositories, but again this might be a challenge, because this is what we can do for maven for some other type of packages. We can do the same, but it's not obvious. We got 13 different languages in license.

B

Compliance and the final solution may depend on the package manager and how the dependencies are involved and.

C

Just for everybody who Kevin was on the call, but for anybody who wasn't on the call, we did confirm the customers using maven.

B

Monie, the great word to start with maven and the next one it will be Python and then JavaScript within human. Your arm and C++ I'm.

E

Sorry, could you run over associate you you? How about the local maven repository there in the ripa in the actual repo for this project, but you said it if they had their maven repository in a another gitlab project within the same instance. That would work as well yep.

B

Well has this project, which is saying that it is where you package list, so here you can see that we have some. We have some packages here. That I mean uploads is our maven packages available in the maven registry? I'll just keep that instance now.

C

If you go back to your config file like you're, specifying which exact maven repo in there correct like there's that line this.

B

Is for when building and also when pitching so the dependency, that's his project, his calling might be available. Well, this man up is a test project, but anyway it's it's working the same way, it's not part of the demo, because once again it simpler to the demand or a job, but it will work seamlessly. The only issue at the authentication is itself so.

C

If they've configured with an get lab, they're dependencies to be pulling from the correct maven repository like they've done that setup, yeah.

D

That makes sense that report shows that you can pull maven project packages from the same project as well as from a different project, hosted in get that, as well as a private project that requires credentials. What we haven't done is actually like a separate maven mirror within the same internet, we're just using get labs. Oh and maven repositories.

B

Yeah thanks but I swear to make sure I understood thanks, yeah the channels, maybe not depending on which solution is used by the customer. They definitely managed to set this up to Bill the project, but we need to find a way to provide that same configuration to the scanning tool. So here the the the the underlying tune is just a maven plug-in, so we can just try to a way to propagate those configurations to the maybud command written by the tool. So it works. That's all some cases it might be harder.

B

So it's a very pure language for package manager, implementation.

B

Alright. So we now have the scanning job that completed. We can see that it's pants on licensees here. So let's have a look at what we are on the Python you now so we can see there is a license tab available here and it's showing a license too for some other dependencies. If I'm clicking there I got some more meta data like the URL, if I'm clicking here.

B

Obviously, it's working because it's my local machine, which has access to the Internet but depending on how your network is set up and how the the engineer and your team members are working, whether on the internet, accessible or not network. This might break. This has been added to the documentation, I think from there. I can also decide to black play start from license. So let's say I'm fine, a license, I can approve it and it will show up in the next merge acquired that this is something I am accepting.

B

I can go back to the merge request page by the way. I can see that the license compliance report is loading here and it detected one license that I can find here and we can see.

B

This is another one because I just the product there's also a quick link from managing licensees directly from the configuration and from there I can decide that I want to, for example, blacklist some more so, let's say I don't want to have any MIT license in my project, I'm sitting at policy that says I don't want any of this MIT license in my dependencies. This doesn't apply to the current request because we don't have any MIT any dependency with an MIT license, so I'm good with that one, so I'm merging it and wise.

B

This will be merging on master. This I can show you that the license compliance page is empty, because this is only fed from what runs on the devil branch and the scanning jug that was currently running was in the feature branch, but now that we are merging it, a pipeline will run under the default branch, which is master, and when it's completed it will feel the license compliance list.

B

Why is it is running? Let's do some modifications, so I will just update my comics ml.

B

By running the web, IDE so by the cleane I will just and comment those dependencies which will make them available. We add a new branch.

B

All right, so, let's wait for all this by applying to run now again, if you have any question, this is a good time to add them.

E

So effectively I'm assuming you've introduced from MIT license with us on commenting your casts is correct. Sorry J says spoiler alert, I.

B

Know that is even more surprise. You'll see.

B

So why I'm here I also show the configuration page, which is something that's skipped, but this has me knighted recently and it tells you which of the secure features have been setup and license. Compliance here is one of them. So it's here it's held that it's not yet configured because none of its jobs has been detected on the latest pipeline on the devil branch. Again. This is looking at the different branch, only hostility here.

B

So this is running.

B

I'm not sure I can cancel the checker yet otherwise we can sell the world job. It's not allowed to fail, so I won't do that I'm! Sorry I will have to wait a bit behind so a spoiler alert. This will fail.

B

So this is looking for specific jobs to run in the pipeline, and this great feature has been added recently at the same time as we are doing a renaming of the other license management into license compliance, and so this is still looking for a job called license management, whereas this is I've been renamed to license scanning to align with the other tools.

B

So we have this ongoing issue that has just been solved in 12.9, thanks to teach IANA, so this will make it working even with the license scanning job, but for this demo this will stay. I am not configured.

B

B

This is definitely too long. This is something that is worth mentioning license. Compliance is too long. Mori made several improvements to try to improve that, but to make the image smaller and to speed up the detection, but we still have a lot of work. Another approach that we are considering for the future is to break this down into multiple analyzers, to have one image for environment, because now the underlying tool which is licensed finder, is handling all the different environments for all the different packages and languages into the same docker image.

B

So you are billing, Java environment, Ruby environments, Python and romantic cetera, which makes it a bit bigger.

B

Alright, so the license canning job has been succeeded and we will have to wait for the checker gap to be down.

B

I will take this time to go back to the SSL check. This is something I I think we all agree that we want to support them in the detector some certificates. Obviously we don't want our sorry try to find back the line. We don't want our customer to use that kind of workaround and disable the SSL checks. So this is something that we are looking as a high priority for 2010 I think we all agree on that. Yeah.

C

Although there is a chance because they're using full chains, even though its internal certificate engines it's like 50/50, and how, if that's gonna, break or not, so we want to work it in case, it does because it may vary across internal chains.

E

Is it? Is it important that we try to have them test this, so we can get that feedback or visit? Does the tie? Is the timing not critical I.

C

Mean we're fixing it regardless and I think we'll have it for 12 10. We may just want to double-check with them like. If they got a failure would doing it. Ssl bypassed be acceptable.

C

Cuz like they, they seem confident that it's gonna work so I, don't when we talked to them. They said, like our chain, usually works, but we may just want to ask like hey if, for some reason, your full chain isn't passing for some reason is SSL, bypassed and approved bypass internally, okay,.

D

It would be alright if we could give them this image and just try cuz. They can use the before script to either install the full chain using the OSS, update, say, certificates or in the case of maven. If they want to use a custom, jks file would.

C

This work with 12:7 with.

D

This work with 12:7: well, yes, because 12:7, you still had before script, get lab, CI, yeah, Mille and so, and you still had root on the image as well, so they can modify the image and whatever way they want. The part that I'm not sure of is like how they're gonna do it if they would prefer to have the root CA installed right into the images like trusted, CA store or if they want to be able to pass like a custom PEM file that they shell directly to do maven.

D

In that case, they can still use the maven CLI options, but there's different ways to accommodate or accomplish that goal. So getting that feedback in terms of which way they would like I think would be helpful if.

C

We can write those options up. We can probably give that to them, although I don't know they're kind of busy right now. So if we've read it up, clearly they might be able to say this is the one we do today. I, don't know if they'd be able to actually do a full test, though okay.

B

One thing: what we need to keep in mind is that we have implemented a seminar solution for all the security scanners, so we probably want to align with them in terms of UX all right, so the pipeline on the master brand is now completed. So hopefully this will now show up here. Yeah we have this apache license to the or showing up here with the least, are the components that packages that are enlarging this using them.

B

Sorry, this license- and this is also looking and linking directly to the corresponding URL again, this might not work depending on the setup of your egg app instance.

B

So, let's go back to our merge request. Now it's your reigning tyranny, so.

B

We added a bunch of dependencies into that merge request and obviously some of them are using a match. License I, don't know which one, but some of them are.

B

And as a reminder, we specifically tell that we are diesel lowing.

B

These along rings is I, don't recall exactly where the sitting is by the way. Thank.

C

B

We are moving by the way, as the settings page is being moved under license compliance section, which will be where to find. So here it is, MIT is being disallowed.

B

All right, nice and scanning it's done so we could show. Probably there is it right now. No, it's failing. Oh it's failing so one other, a failure probe its failing, because I just wanna see the network town, it's probably because it's not yet completed.

B

Now that the pipeline is complete, it's working alright, so we know how to tick, tick, five, new licenses and yeah- we might be here, but it's still considered as unknown. This is not the best you eyes or something we're working on, but the great circle means we don't find any existing policy. Regarding that specific license, so you're all wondering. Well, we disabled. We specifically like listed my MIT license, so why it's not working! This is a known issue.

B

As you can see, this is reported as being MIT license, whereas what we put into the management of the licenses is just MIT, and this is something that we've done recently, which is about normalizing the license name to improve the matching. So this is not working in the ëget instance, because we have a cron job that regularly checks the s PDX database to get the latest ideas.

B

Put them to our grid, lab instance database and then make sure to update all the license that we found in the reports and update them to get this new ID. So we have normalization stuff happening at that moment, which makes the matching between the policies and the scandal that we find in the project to be way more efficient. And here it's failing, because this is not the same name.

C

No, it's not failing it's doing, exact match, and and so it's how less nice user experience. But since we can't go check that resource with a cron job, they get precise matching only instead of imprecise matching.

E

So, just to be clear, if you had typed in in previous steps, MIT space license.

C

Yeah, what, if that would have been a successful, do not allow, because it just.

E

Had to be exact match case sensitive.

C

E

C

E

C

It is I think it counts, periods, spaces and I. Think cases or his case is not in there. I know its periods in spaces matter. That's.

E

Okay, thank you. Can you intensity and.

D

This is our air gap. Note, but yes, I believe it is case insensitive just looking it up right now, so the behavior in get lab comm is, it would have matched MIT there, but there sorry.

B

So I just had a mighty license as a black listed one, and now it's reporting correctly. So again, this would be fixed. We've tried to figure out a way to bundle that index into the omnibus package so that it's available for self manage instances so that it improves the matching algorithm all right. So let's merge this one and please see this showing up in the license. Compliance page as also a final point. I just want to make sure that we agree on how to prove that any album called we're made from the yep instance.

B

We tend to agree that having the check I got job showing that it's failing is enough, but we also we're discussing that. We need to do some that cut commands on the get asked. I was doing it yesterday with this. What I end up with is what I think we make more sense demonstrate that so here is the log viewer from the instance, which is catching every traffic that is being handled by the rule that we've set up and one of them being. We disallow any outgoing calls.

B

So if I'm trying, for example, to reach out to.

B

Okay, so if I'm trying to reach out to the SSH part, so I'm typing here using netcat I want to reach out to the bastion host on port 22. I should see that this has been rejected.

B

B

I'll, just roll out that page to get some data slugs. So, as you can see, I cannot connect. This has been turned out and we shall see. We should see here that this is due to the firewall rules blocking that traffic.

B

Why am I looking.

B

All right just looking at the power, it would be great to have the start of I most recent items. First,.

E

You know what you word, you can filter, I. Think.

C

If you click jump to now over the top it'll thanks.

B

That's a good one. I'm ready I'm worried that far with that one. So here we can see that we are one attempt to connect. Well, that might be not the correct one, because it's trying on.

B

T-This is supposed to be 22 and here's trying to reach 4 4 4 3. So it's not the correct one. All right so I will hit my head because I was saying this could be seen for.

C

Entries I guess.

C

And this is yeah. This is like being a firewall eyed minion, zero percent, fun.

B

Its mother working fire Billy last night when I was testing this so demos stuff anyway. This is something that we can dig further, but unless your specific net cut command that you wanted me to run to prove that. But my point was that running that cat command from the I got asked to try to reach out to the extent to the outside might not be approved that you are fully again because you can fail to reach out for any other reasons and then having a specific firewall blocking this I'm. An expert in that area.

B

So please feel free to ask anything. Even what you want me to do to check that.

E

Yeah I mean I, think the the other job that you had combined with the original pipeline before he modified the animal.

E

It's probably adequate sorry.

B

C

Using the job in the pipeline was enough, we.

E

Know the combination of the two, so you you, you should a pipeline fail when you hadn't properly set up the yeah Mille with all the options, the overrides of the image name and so on right. That was the first pipeline. You did. If you go into the pipeline history, there's there's the one that failed license canning right, because it's range right, yeah, so I think that, combined with the running job that succeeds, when you can't do a double you get in.

E

The combination of those two is, is probably a good a good way to do it not only test it, but also to show it in these tattoo demos, well better than the firewall rules, but everything's being denied everything. You've opened has been denied so yeah.

B

Sorry, we can't see this one that I just tried finally found it. So Turing are trying to reach out to this AP this part and being denied by the specific rules on egress traffic.

B

Alright, this and the demo that you want to go through the scorecards now just stop the recording and continue after so.

A

Yeah I think we should definitely go through the the scorecard and and and grade where we're at with these I.

A

Don't know if I mean I, don't have a problem with it being recorded for for how we grade and what the rationale was I don't know if others have a differing opinion on that.

F

Thanks for this I add a comment in an item: I'll I think we should be grading as we go. We don't forget the context of white-white fail. Wipe ass and call out. I also wanted to point a foster that we have single source of truth. So if there's like I, think I sort of truth in the scorecard, why the scores low, let's put it in the notes.

F

So we have kanuha T on the progress week week and if the raw meeting notes can be in the in the agenda document and just have have the suitable things doing their own thing, but deduplicated as much as we can I love to hear back from the team. What do we think.

B

That makes sense to me. The only drawback might be that the the script of the demo might not match exactly the test that we are grading here, so it sometimes might be hard, but I smile, because.

C

B

This I agree: I.

C

Time-Stamped everything in the notes that I took on the demo itself and you'll see that there's a lot of going back and forth so I mean I. Guess we could figure out when the second point or the closure point is and then do the checks at the closure points.

F

I I think the timestamps are great. I also agree that the timestamp a mid fool for in its full form 1 will explode the comment section in the scorecard, so full what I.

C

Was specifically.

F

Trying to what a line action I didn't for the next time we need to look out for I was.

C

Specifically, trying to address your question around, we should do the checkpoint throughout I think when we hit the closure point or the second check-in point for each one of the issues. Maybe that's when we call a pause to do the discussion and score yep.

F

I was like I think, that's great. That said,.

C

We'll do that next time. Thank.

F

You then Cole appreciate that so I start from the beginning.

C

Well, let's go through and see if we need to go through anything again like it sounds like we were discussing point number 27, oh right now, so I guess we're going backwards. I don't know, but do we want to complete that conversation? The note they took was that the combination of the original settings file and I should probably be specific settings. Yeah mo file failure combined with the running job, which I think it's called like check, air gap, I, think or test air gap test.

C

Air gap on pipelines is sufficient and that was for proving that the jobs didn't callout. Is that an accurate summary of that piece.

E

C

So would you say we proved that sufficiently and it's a 5 or maybe we didn't prove it sufficiently and it's lower score.

E

I think, yes, sure, that's a fine.

C

All right do we want to work top down for the raster, what would be a best approach and we might need to go revisit some stuff just to get clarity.

A

Yeah I'd vote for top down personally, okay.

C

So if we're looking at that, then we should be looking at l23, which is proving that the environment itself was air gapped, which, if I flip back to the notes, the method that we did. That was, we showed the host in the bastion with the mermaid diagram and then did a check to note. And then we also noted we were using a host file and that's why we had a web address so I mean my personal comment on this is I.

C

Think we we've proven the host itself in both fast and licensed scanning is locked down, but I, don't remember a specific call-out, proving that the bastion only has the one connection to the hosts. I. Think that's my only one point of I think.

E

The bastion is relevant, I think the issue. There was last time we wanted. We, the demo involved the neck neck man being done on one and I thought. I thought it was a good idea just to show it on both to show you the difference in the results. That's all so.

C

I mean to that similar point. If we just proved with the firewall logs that the host was locked down, do we need to also prove that it's only like the certain ports that are allowed for most a bastion to like solidify that the host bastion connections, limited.

E

I think the the outbound from the from the test host is the the critical thing the the inbound from bastion to you to the test being locked down to just two ports. Is it's probably less less relevant I? Think the most relevant thing is just that the host you're testing on has no no egress method.

C

Okay, so your most important thing is, and I can't spell. The word. Egress apparently, is that the hosts egress is limited for.

E

Yeah yeah blocked in this case right well.

C

It's limited to only the two ports to the bastion. No.

E

No ingress to the host is where it's from the bastion, but egress would be zero ports, I think I'm yep.

C

And did we sufficiently prove that or do we need to do a better job of proving that egress is zero.

B

Well, when we are demoing it that we cannot the car images, we cannot ping, we cannot reach 422. I can do super because, like that, but if we want to exhaustively list like we cannot do edit connection on any part, we need a tool that will do a full scan, and this is also a tool that the customer would agree with, which is definitely a more complex setup to me right.

C

But in this case Kevin's being the customer, so is what we did right now for you Kevin, okay, or would you like us to do more on a future damn I.

E

Think we just I think it'd be good to be consistent across the demos and decide what the wording of D is gonna, be, which we don't have to do here and end and then have it consistent across the demos would be nice but I. Think in this case we have shown the ones that I mean you've tried out on twenty to forty four three and eighty would be the ones that I would really want to see are being blocked on the hosts are the key ones.

E

I, don't think we need to do a full port scan, for example, so so.

C

E

Would say in this case you get consistency.

C

For the rest of them, yeah.

E

I think whatever that first step is, it would be nice to be whatever we decide on and I'm, not saying that one is necessarily better than the other I think would just be nice to be kind of the same thing. Okay,.

C

All right, so in this case, are we happy with the fact we think it's offline I'm.

E

Convinced the test was done in an inadequate manner that the improvements really more on the card.

C

E

The approach to is where I would want to see it.

C

So we should work on that for the upcoming demos and try and set something across all teams, and that should it resolve that one I don't know are we allowed to like put a comment? I'm gonna put a comment.

E

Is everyone using the same Bastion in the same test host? Yes,.

C

E

So if we have tools on there to do something, then that should be.

B

Easy, no, we can't put that into scripts and that all of the team or running this at the beginning and showing what it contains.

B

Again, the point is that the working rules are from the firewall. This is not something you can check easily at the OS level right, oh yeah, yeah I am sure.

D

We could enable the OS level iptables rules and then you could see the drop policy if you wanted to what.

E

We're running short on time and the demo recording, let's just say, let's get through the rest of the score and then.

G

What works at one hour as a follow-up yeah.

E

Imprinting the scoring process later.

C

So 24l is, this is show the setup and config. So we did the bonus of turn on license compliance ensure that it failed with the default configuration setting we followed in this case. It was not user documentation. It was you know, copy-paste from file, because we don't have public user documentation first, so you can ding us for that, one if you want and then after pasting, that in we were able to run a pipeline successfully, so that was that step. So how do you feel about that way? I would.

E

Say let's do a four on that one and then, when we go, we post the user documentation I'm happy to upgrade that to a five I. Don't.

B

Want to lose sight of that I mean I, know you're not going to lose sight.

E

B

Mean I tend to have more office 3, because we still have an incomplete work and that when you talk about the documentation, we don't know yet what we will each lately printed documentation. We asked several workarounds here to achieve my work. This is not the final solution, one a ship yep, so.

C

It's a three pending review of completed document.

E

It's nice to actually follow the documentation in the final demo, because then customers know okay cool. This is gonna work, but for this to every demo, it's fine, but.

F

Yeah, okay team there's also a note in ye Roman numeral 7.1 on over I focus inserts because not working yet in the in the doc. Is that something we have to capture you as well.

C

So I don't think this one impacts our score. I think this one is a follow-on for Kevin to confirm if the customer is concerned about that one. So do you have that one as a takeaway to find out how they're like to work with mo to be like hey, here's, how you know you can do the Maven with your certificate. Is that the way you're currently doing it I should probably add more words to this one. So you can so yeah.

E

I might need a little bit I'm, not an expert I might be a little help with the wording to make sure I get it right. When I submit the question.

C

To craft the choices on certificates set up and Nathan to go to customers to see, if that's how current Maven repo is configured with SERPs duh, how did that comment? Do we want to add that into this document as well?

C

Just until it's done I.

F

Believe a minor excerpt there will be great, and this is this is our doc. So if you want to put comments directly in a scorecard and assigned you to other folks, like I'll stakeholders who treated you like Nicole,.

C

Driver comment, and this one is the same to Kevin and say meant to people yeah.

E

You're, just just in the Google Doc you staff mentioned both there, you go.

C

We now have a comment that has to get resolved on that. One awesome.

F

C

And so the next one is the actually adding the code, in this case uncommenting some code submitting the mr and having the pipeline successfully complete the license compliance job.

E

Yeah that was completed.

C

And we did have the item where we pointed out that we're using the gitlab maven repository not a custom one. Did you want to share that with the customer preemptively yeah.

E

I'll mention to them and see if they I kind of got a feeling when we talked to them the other day that they were using, they actually stood up. They actually have our ho student I agree.

C

With you even repository.

E

But so Mike yeah, okay.

C

I'm gonna put that one as.

A

C

C

Need a bigger monitor: this is a very wide squirt card, all right. So what so do we feel that was a five pass, or did you have any concerns about that? One that you wanted to hold off until we got something.

E

Those for, let me confirm you can give me an action to confirm on the Maven password, but I I can't imagine that the manor-house reacts significantly differently between but yeah. Just let's just do it as a floor right now, I think that's fine!.

B

I think, maybe that specific task is a bit miss lane, because everything that is been put in, that part doesn't actually have an impact on the and the feature itself like medical changes, submitting requests and wait for the pipeline to run this.

H

B

Right this is involving the gate feature. The pipeline feature request features, but it's not I mean what is pending and our side is a next one which is showing results, but.

C

In theory, if the job couldn't reach out to the private maven repo, wouldn't the pipeline not complete the running.

E

Honestly, I'm fine, with 25 being a 5 and 26 being okay I, just it it's kind of potato putana to me. I do agree that it did run and it did give us the results. We we expected the only thing I'm gonna check on it is the looking listed versus self-hosted and if, if they anticipate, there's a significant difference there that we want to do any testing with a with a self-hosted one. Okay,.

C

So we'll call that if the pipeline starts running, that's 25 and the completion is in 26, so we'll switch this one to a 5 and then we'll move this note down into the next one. So.

B

I think it's great because it makes a difference between the detection capabilities, for example rest as there isn't. That also depend on the execution of the job itself, so yeah.

C

B

C

Right so did we have 26 the pipeline results?

C

What concerns have we got there? I.

E

Think the only things that are that are listed there presently only concerns whatsoever and I'm not stressed about the known issue with the MIT versus the MIT license. That's that's not a huge deal and.

E

And I'll just confirm the other one and weep I can get that one to a five as well.

F

There's also like note on the timing issues: it's okay, we don't want, you don't need to track it. It's part of this there's a point. G Roman numeral, seven point to look at you.

C

Also known as license scanning takes forever yeah.

F

So yeah, let's just image, is gonna, be an improvement after this, let's make it clear and manage expectations and then make sure Kevin. It's also signing off on it as well.

E

Yeah sure um the only other question I had was for this section is just it is more a question for the engineers, because I just I just don't know, do we feel that this is doing this with with the Maven.

E

It obviously proves out the capability when we get to the next, the next one that's going to be added. Do we need to do this again, or is the mechanism that's being proven already proven, and that's more of a quality engineering we're.

C

Gonna have to kind of do it slightly differently for pythons I think we're gonna have to do a Python demo, yeah.

E

That we might want to duplicate this section and believe all this is like maven licensed versus just overall. This is someone reviewing. This layout doesn't be confused at all.

C

I mean like in the future I would like to have a more unified approach, but that is not happening in 1210 I. Don't think unless Bo tells me that there's some magic unicorn sandstorm.

D

I predict in a couple months from now, I will know if more unicorns, but right now, I can tell you that this was focused on maven and we'll have to go. Look at each package manager individually. It's.

C

100% legit, okay,.

D

F

I will look for those unicorns on the way. Do we need to capture new scorecards to track Python and other language.

C

So for MVC we are doing maven and we're doing Python, pip or I should say we're doing, Java, maven and python pip as the two targets for MVC. So we should probably capture those both separately. Other items are in the post, MVC epoch, as confirmed yesterday. We will get to them earlier if we can, but we must finish those two got.

F

It okay! So what I'm, when I work with you Nicole offline, to UM expand this a little bit into them? You can take it over from there.

A

All right, so we are at time anything else before I end the recording.

H

I'm going to selfishly ask since we've got some shared aspects of these demos, namely environmental that were not at five's. Yes, last Friday, but are at 5s as of today. Do those go up just.

D

To piggyback on your question, Thomas up my other concern about the environment: it's like I, don't have a Python package registry mirror in this air gap environment. With the maven example, I was able to use the get Lab hosted, maven repository, but that's another I guess. Infrastructure related concern.

C

So for the first one, my vote would be for the proof set up and prove air gap and then the show, if applicable, I, think those should be universal because its environment specific. So if the scores and those go, my vote would be that they go up across the board. But people can down vote that or whatever I.

F

Think, let's just show it like, you, don't have to dive in and show the whole thing, but this makes it show and revisit it make sure we don't regress and quality is working on the other, bigger environment and running full requests on it. So there's also the opportunity to catch it there and retest everything at the whole end-to-end flow. So, let's make make it lean lightweight for them make sure we call back and say.

C

Yeah Thomas: we can pump your first and last device and then, though, I think we have to work with quality, to figure out how to get one stood up. Unfortunately, like that's I, don't think there's a way around that one is.

D

There a point of contact I can, oh, it will will. Are you my way to contact well.

I

Initially I was planning on using a script, would have used steps similar to Greg Suhr cup steps, but that was kind of parked and we'll look at the environment builder. But it looked to be a bit overkill.

I

Lacunae is leveraged in github here so that we can utilize our existing test pipelines and just spin up an air-gapped docker container. But if there's something different you made, maybe I could revisit our initial script. If there's an eval unit for for ourselves.

D

I

Right, thank you. I'm.

A

Gonna go ahead and stop the recording right now, unless there are any objections. No all right! Thank you. I'm gonna, stop.