GitLab Secure Stage, 2 Apr 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: 2020-04-02 Dependency Scanning Offline environment demo for JS projects with npm

Description

Related project https://gitlab-airgap-test.us-west1-b.c.group-secure-a89fe7.internal/2020-04-02-ds-demo/js-npm

A

All right come everybody. This is a smaller video about testing support of JavaScript, with NPM package manager in an offline environment. So we are using a custom NPM registry within this type instance, which is available. This asked, which is a regard SEO instance, and we have added specific ingress rule and Kezia get test instance so that it can reach out. Does this on the local network so we'll start by creating a fork of that template project we've had that does is dedicated group here.

A

And I will also break the fork relationship, so that doesn't bother me when creating some merge requests alright. So we are this project now, which is having a single dependency which is low, and the duration has some flows for the purpose of this demo.

A

This project has been configured with this custom registry to be used. They load and clean dependencies and SS all false, because we don't have it support for an self-signed certificate. So let's go ahead and setup.

A

Dependency scanning for this, so this is a template. We are using just that within the negative environment. So I will add a collapse. Yeah yeah, no fire here so we're, including the defenses cutting job disabling the token doctor mode specifying where to find those images specifying where to find in the register, dodgiest at Israeli databases and the gymnasium database. We're also disabling SSL check for a get call so that we can clone and 50 get 333 for the change of database.

A

These are temporary worker and until we can fully support subsides educates- and this is checking a good job which is verify that we in this job, we cannot reach out to the public registry. The job will fail if it can reach out to the registry or it will succeed if it cannot reach out to the registry.

A

So let's come at this.

A

Any a new branch and immersion that.

A

So we should not have the pipeline running where the two jobs to needs your dependency scanning and retouch of the prince is gaining with rather to compatible analyzer with JavaScript projects, and we also district never give job here is pending, because we only have two burners. Oh it's writing. So we know Tunisian defense is scanning that past it could successfully get the chimneys and DB from this repository, and then we have retired years dependency scanning job, which is failing.

A

It's it's successfully downloading the dependency that works, but when it tries to get that advisory under the external Gentiles, it sounds too crazy and Li and exactly the status one. So we need to investigate further on why we Church is not capable to do the analysis and something here my assumption that there is an SSO check that is failing here, went on loading this files, but we need to investigate earlier so going back to the script.

A

We can now see that in the Python do we have the security tab that is now filled with what has been found from the tea medium analyzer, and if we go back to the met request, we can see this is action. Those are reports available here with the detected vulnerability here.

A

And what's up there, so thank you for watching every day.