GitLab Secure Stage, 21 Sep 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Container Scanning Transition Sync Session

Description

This is a recording from the meeting Container Scanning Transition Sync Session, where we have discussed the transition of Container Scanning feature, from Govern:Security Policies to Secure:Composition Analysis.

A

Okay, hello: everyone uh welcome to our meeting uh container scanning transition sync session uh today. We're gonna talk briefly about the transition itself uh and, as we had the document here, uh we had two questions: I'm gonna just answer them and we'll see if we're gonna have any any more questions on the way.

A

So the first question is: are the licenses inside legal updated automatically? For example, if three used license a and then transition to license b nope? uh I believe we had a long discussion with legal team about the whole licensing stuff, because we also had some concerns about uh licenses for alpine um database.

A

If I correct correctly so I will post the link to the issue here where we, it was all discussed, but no, it's not automatically. So at some point we either want to to have some check for that or I will just do it every month or something uh just to verify and uh and the other question uh howard. Somebody would like to add something to that.

B

Yeah, so I can just clarify that a little bit so the actual underlying source for the alpine vulnerabilities is in the public domain. So there is no license attached. It's just public information, so we're free to use that but trivi.

B

So alpine has a project that actually takes all of that vulnerability, data and extracts it parses it out and puts it into a database, that's convenient and easy to use, but that database or sorry the the code, the go code. I think it's go anyway. The code that generates that is licensed with a shift left license.

B

So we realized that trivia was actually pulling from that the the that data source instead of the upstream public data source. So for that one we actually have to strip it out, and then we basically re-implemented our own parser.

B

That does the same thing more or less, as you know, is that repository that alpine generated to go through and pull out that information, but it's all code that we wrote ourselves and so that way we have permission to use it. So that's why alpine is a special case.

B

We actually also have issues with. I think oracle linux, but that's only for older vulnerabilities and that one's much less popular. So it's not really a big deal.

B

I think we actually just remove those or don't use them as well, but you know we haven't replaced that with our product, because it's just there's less demand for that and plus all the new vulnerabilities are appropriately licensed, so it's only really old vulnerabilities that would apply anyway.

A

Yeah thanks sam um okay and other question about ee features uh how they are enabled. So we have this ello list feature that should not be available on free tier. I'm gonna just quickly share my screen and, let's see.

C

A

So, in terms of this list now, I believe, you've seen the video when I briefly went through the to the source code and how it's built like it has plugins and so on. So in terms of allo list, there is this method called build, outlist, and if environment is ae, it will not include the allo list generated from from this file and how we are checking if it's e or not like, we simply check the github features um variable. So, when you're running a pipeline, you get these features populated with the features that are enabled.

A

So if it's not ee, this container scanning will not be included and that's it.

C

Thank you for going over. There.

A

All right anything else.

A

Okay cool, um so just just one thing from me: um I went through whole like all issues and all features that were uh in our backlog and I if they were not started or they were not like in progress and death or an interview. I I kept them in our group for now so we'll finish them any important box. I mean customer box and so on. uh We've decided to to take into this milestone to quickly fix them.

A

So you'll not end up with uh bugs with due date that you need to work on immediately, um but anything else like features proposals and so on, went to to your group, and I believe I did it yesterday.

A

So if you have any questions we'll here to to help you with all the refinements and all understanding, uh so let us know if you need anything.

A

Okay, so thank you for this quick meeting um enjoy the rest of the day and have a nice one. Bye thanks, bye.