Patch Grafana against session cookie vulnerability and CVE-2023-1410

See merge request https://gitlab.com/gitlab-org/security/omnibus-gitlab/-/merge_requests/326



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Robert Marshall <rmarshall@gitlab.com>
Co-authored-by: Balasankar "Balu" C <balasankar@gitlab.com>

Balasankar C authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-grafana-session-cookie-outgoing-request-15-11' into '15-11-stable'

See merge request gitlab-org/security/omnibus-gitlab!326

Changelog: security

[ci skip]

Use latest stable tag in the repo as fallback for stable branches

See merge request https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/6836



Merged-by: Mayra Cabrera <mcabrera@gitlab.com>
Approved-by: Mayra Cabrera <mcabrera@gitlab.com>
Co-authored-by: Balasankar "Balu" C <balasankar@gitlab.com>

Balasankar C authored 1 year ago and DJ Mountney committed 1 year ago

Signed-off-by: Balasankar "Balu" C <balasankar@gitlab.com>

Bump geo-ci tag for triggers to 0.5.0

See merge request https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/6825



Merged-by: Robert Marshall <rmarshall@gitlab.com>
Approved-by: Robert Marshall <rmarshall@gitlab.com>
Co-authored-by: Balasankar "Balu" C <balasankar@gitlab.com>

Use goexperiment boringcrypto for golang 1.19 fips

See merge request https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/6813



Merged-by: Balasankar 'Balu' C <balasankar@gitlab.com>
Approved-by: Balasankar 'Balu' C <balasankar@gitlab.com>
Co-authored-by: DJ Mountney <dj@gitlab.com>

Signed-off-by: Balasankar "Balu" C <balasankar@gitlab.com>

Use new Gitaly configuration format to set default storages

Closes #7743

See merge request https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/6808



Merged-by: Robert Marshall <rmarshall@gitlab.com>
Approved-by: Robert Marshall <rmarshall@gitlab.com>
Co-authored-by: Balasankar "Balu" C <balasankar@gitlab.com>

So that non-actionable deprecation notice about gitaly['storage'] is not
shown to users.

Closes https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/7743



Changelog: fixed

Signed-off-by: Balasankar "Balu" C <balasankar@gitlab.com>

[ci skip]

Add support for the workhorse google storage client configuration

See merge request https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/6530



Merged-by: Robert Marshall <rmarshall@gitlab.com>
Approved-by: Jason Young <jyoung@gitlab.com>
Approved-by: Robert Marshall <rmarshall@gitlab.com>
Reviewed-by: David Fernandez <dfernandez@gitlab.com>
Co-authored-by: David Fernandez <dfernandez@gitlab.com>

When using a consolidated configuration in object storage and the google
provider, we will set up workhorse so that its native google cloud
storage client gets set up too.

Related https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/7324

Changelog: changed

Bump Container Registry to v3.71.0-gitlab

See merge request https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/6816



Merged-by: Robert Marshall <rmarshall@gitlab.com>
Approved-by: Jason Plum <jplum@gitlab.com>
Approved-by: Robert Marshall <rmarshall@gitlab.com>
Co-authored-by: Hayley Swimelar <hswimelar@gitlab.com>

Upgrade registry from v3.70.0 to v3.71.0.

Related https://gitlab.com/gitlab-org/container-registry/-/issues/987

Changelog: changed

[ci skip]

Use CI image name in gems cache key

See merge request https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/6801



Merged-by: Balasankar 'Balu' C <balasankar@gitlab.com>
Approved-by: Jason Plum <jplum@gitlab.com>
Co-authored-by: Stan Hu <stanhu@gmail.com>

Move geo-postgresql settings to underscored form

See merge request https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/6761



Merged-by: Robert Marshall <rmarshall@gitlab.com>
Approved-by: Andrew Patterson <apatterson@gitlab.com>
Approved-by: Robert Marshall <rmarshall@gitlab.com>
Co-authored-by: Balasankar "Balu" C <balasankar@gitlab.com>

Migrate node settings from hyphenated form to underscore form for
all geo-postgresql service related keys.

Changelog: deprecated

Signed-off-by: Balasankar "Balu" C <balasankar@gitlab.com>

Bundle libarchive in the package

Closes #7741

See merge request https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/6805



Merged-by: Robert Marshall <rmarshall@gitlab.com>
Approved-by: Robert Marshall <rmarshall@gitlab.com>
Approved-by: Andrew Patterson <apatterson@gitlab.com>
Co-authored-by: Balasankar "Balu" C <balasankar@gitlab.com>

If libarchive is present in system library locations and not bundled
with omnibus-gitlab package, then Chef will incorrectly attempt to use
it, and can potentially fail as seen from
https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/7741. Hence, we
need to bundle libarchive in the package.

Changelog: added

Closes https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/7741



Signed-off-by: Balasankar "Balu" C <balasankar@gitlab.com>

- Only add boringcrypto where needed in omnibus

Use AlmaLinux 8 for EL8 package builds

See merge request https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/6802



Merged-by: Jason Plum <jplum@gitlab.com>
Approved-by: Dustin Collins <714871-dustinmm80@users.noreply.gitlab.com>
Approved-by: Jason Plum <jplum@gitlab.com>
Reviewed-by: Jason Plum <jplum@gitlab.com>
Co-authored-by: Robert Marshall <rmarshall@gitlab.com>

Expand the MR Default template with some clarifications

See merge request https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/6753



Merged-by: Balasankar 'Balu' C <balasankar@gitlab.com>
Approved-by: Dmytro Makovey <dmakovey@gitlab.com>
Approved-by: Balasankar 'Balu' C <balasankar@gitlab.com>
Reviewed-by: Balasankar 'Balu' C <balasankar@gitlab.com>
Co-authored-by: João Cunha <j.a.cunha@gmail.com>

- Makes it clearer the expectations regarding the manual jobs that need to
  be executed.
- Makes it clearer what is the expectation regarding the GitLab.com
  pipeline.

Update prometheus from 2.38.0 to 2.43.0+stringlabels

Closes #7655

See merge request https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/6797



Merged-by: Balasankar 'Balu' C <balasankar@gitlab.com>
Approved-by: Balasankar 'Balu' C <balasankar@gitlab.com>
Co-authored-by: Clemens Beck <cbeck@gitlab.com>

Clemens Beck authored 1 year ago and Balasankar C committed 1 year ago

Changelog: changed

- Update ohai helper to code AlmaLinux as a variant of Enterprise Linux
- Use AlmaLinux 8 instead of CentOS 8 for EL8 package builds

Related https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/6712



Signed-off-by: Robert Marshall <rmarshall@gitlab.com>

Remove ee folder for non-ee builds

See merge request https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/6803



Merged-by: Balasankar 'Balu' C <balasankar@gitlab.com>
Approved-by: Balasankar 'Balu' C <balasankar@gitlab.com>
Reviewed-by: Balasankar 'Balu' C <balasankar@gitlab.com>
Co-authored-by: Andrejs Cunskis <acunskis@gitlab.com>