Dmitry Makovey authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-82-15-10' into '15-10-stable'

See merge request gitlab-org/security/omnibus-gitlab!321

Changelog: security

[ci skip]

Fix SSH host key generation on CentOS 7

Closes #7671

See merge request https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/6756



Merged-by: Robert Marshall <rmarshall@gitlab.com>
Approved-by: Jason Plum <jplum@gitlab.com>
Approved-by: Robert Marshall <rmarshall@gitlab.com>
Reviewed-by: Robert Marshall <rmarshall@gitlab.com>
Co-authored-by: Stan Hu <stanhu@gmail.com>

The version of ssh-keygen shipped with CentOS 7 does not support
the ability to save SSH host keys to an alternate path using the `-f`
option with the `-A` option. Keys will always save to `/etc/ssh`.

To fix this, manually call ssh-keygen for each key that we want to
generate. On FIPS systems, it's not guaranteed that ed25519 or other
keys can be generated, so we skip over any failures in `ssh-keygen`
and only check at the end to see if any keys were successfully
generated.

Note that the host key generation is only performed if no host keys
were detected in the directory in the first place.

Closes https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/7671

Changelog: fixed

Add stable branch template

See merge request https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/6762



Merged-by: DJ Mountney <dj@gitlab.com>
Approved-by: DJ Mountney <dj@gitlab.com>
Co-authored-by: Mayra Cabrera <mcabrera@gitlab.com>

Turn on the pg upgrade recommendation notice

See merge request https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/6611



Merged-by: Robert Marshall <rmarshall@gitlab.com>
Approved-by: Robert Marshall <rmarshall@gitlab.com>
Reviewed-by: Robert Marshall <rmarshall@gitlab.com>
Co-authored-by: DJ Mountney <dj@gitlab.com>

Our expressed intent is to remove PG 12 in GitLab 16.0, so we need to
start recommending upgrades.

We will turn on auto-upgrades for single node installs in the release
before 16.0.

Changelog: changed

Add a merge request template to be used when backporting bug fixes into
Omnibus stable branches.

Related to https://gitlab.com/gitlab-com/gl-infra/delivery/-/issues/2886
and to https://gitlab.com/gitlab-com/gl-infra/delivery/-/issues/2890

Added duo auth config to gitlab.rb

See merge request https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/6752



Merged-by: Balasankar 'Balu' C <balasankar@gitlab.com>
Approved-by: Vladimir Shushlin <vshushlin@gitlab.com>
Approved-by: Balasankar 'Balu' C <balasankar@gitlab.com>
Co-authored-by: smriti <sgarg@gitlab.com>

Bump Container Registry to v3.69.0-gitlab

See merge request https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/6759



Merged-by: Robert Marshall <rmarshall@gitlab.com>
Approved-by: Robert Marshall <rmarshall@gitlab.com>
Approved-by: Jason Plum <jplum@gitlab.com>
Co-authored-by: Hayley Swimelar <hswimelar@gitlab.com>

Related https://gitlab.com/gitlab-org/container-registry/-/issues/947

Changelog: changed

Move remote-syslog settings to underscored form

See merge request https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/6740



Merged-by: Robert Marshall <rmarshall@gitlab.com>
Approved-by: Jason Young <jyoung@gitlab.com>
Approved-by: Robert Marshall <rmarshall@gitlab.com>
Co-authored-by: Balasankar "Balu" C <balasankar@gitlab.com>

Related https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/6873



Changelog: deprecated

Signed-off-by: Balasankar "Balu" C <balasankar@gitlab.com>

Move gitlab-exporter settings to underscored form

See merge request https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/6738



Merged-by: Robert Marshall <rmarshall@gitlab.com>
Approved-by: Jason Young <jyoung@gitlab.com>
Co-authored-by: Balasankar "Balu" C <balasankar@gitlab.com>

Related https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/6873



Changelog: deprecated

Signed-off-by: Balasankar "Balu" C <balasankar@gitlab.com>

Move suggested-reviewers settings to underscored form

See merge request https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/6739



Merged-by: Robert Marshall <rmarshall@gitlab.com>
Approved-by: Jason Young <jyoung@gitlab.com>
Approved-by: Robert Marshall <rmarshall@gitlab.com>
Co-authored-by: Balasankar "Balu" C <balasankar@gitlab.com>

Related https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/6873



Changelog: deprecated

Signed-off-by: Balasankar "Balu" C <balasankar@gitlab.com>

Move gitlab-shell settings to underscored form

See merge request https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/6741



Merged-by: Robert Marshall <rmarshall@gitlab.com>
Approved-by: Jason Young <jyoung@gitlab.com>
Approved-by: Robert Marshall <rmarshall@gitlab.com>
Co-authored-by: Balasankar "Balu" C <balasankar@gitlab.com>

Related https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/6873

Related https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/7455



Changelog: deprecated

Signed-off-by: Balasankar "Balu" C <balasankar@gitlab.com>

Bump Ruby version to 3.0.5

Closes #6287

See merge request https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/6736



Merged-by: DJ Mountney <dj@gitlab.com>
Approved-by: DJ Mountney <dj@gitlab.com>
Co-authored-by: Balasankar "Balu" C <balasankar@gitlab.com>

Balasankar C authored 1 year ago and DJ Mountney committed 1 year ago

Signed-off-by: Balasankar "Balu" C <balasankar@gitlab.com>

Add prometheus to dependency automation

See merge request https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/6737



Merged-by: Balasankar 'Balu' C <balasankar@gitlab.com>
Approved-by: Balasankar 'Balu' C <balasankar@gitlab.com>
Approved-by: João Alexandre Cunha <j.a.cunha@gmail.com>
Co-authored-by: DJ Mountney <dj@gitlab.com>

Use Ruby 3.2.1-based docs Docker images

See merge request https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/6750



Merged-by: Jon Glassman <jglassman@gitlab.com>
Approved-by: Jon Glassman <jglassman@gitlab.com>
Co-authored-by: Evan Read <eread@gitlab.com>

Duo Auth support as OTP provider is added.
This change will help the omnibus build to add configurations

Changelog: added
MR: https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/6752

Make geo-logcursor group configurable

See merge request https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/6728



Merged-by: Balasankar 'Balu' C <balasankar@gitlab.com>
Approved-by: Balasankar 'Balu' C <balasankar@gitlab.com>
Approved-by: Jason Young <jyoung@gitlab.com>
Co-authored-by: Mike Kozono <mkozono@gitlab.com>

Add cpu_quota_us Gitaly config

See merge request https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/6730



Merged-by: Balasankar 'Balu' C <balasankar@gitlab.com>
Approved-by: Will Chandler <wchandler@gitlab.com>
Approved-by: Balasankar 'Balu' C <balasankar@gitlab.com>
Reviewed-by: Will Chandler <wchandler@gitlab.com>
Co-authored-by: Steve Azzopardi <sazzopardi@gitlab.com>

Disable zstd decompression support with libmagic

See merge request https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/6749



Merged-by: Robert Marshall <rmarshall@gitlab.com>
Approved-by: Robert Marshall <rmarshall@gitlab.com>
Co-authored-by: Stan Hu <stanhu@gmail.com>

Deprecate legacy Gitaly configuration options

See merge request https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/6670



Merged-by: Robert Marshall <rmarshall@gitlab.com>
Approved-by: Hossein Pursultani <hpursultani@gitlab.com>
Approved-by: Robert Marshall <rmarshall@gitlab.com>
Co-authored-by: Sami Hiltunen <shiltunen@gitlab.com>

Gitaly's configuration in Omnibus has been updated to structurally
match Gitaly's own configuration. The new configuration keys go
under the `gitaly['configuration']` key. This commit deprecates
the old keys that were replaced by the new configuration.

Changelog: deprecated

Also refresh Markdownlint and Vale rules from GitLab project.

ruby-magic updated to libmagic v5.44, which added support for zstd
decompression support. Unlike most of our other builders, it appears
that Amazon Linux needs `libzstd` to support `dnf`.

With ruby-magic v0.6.0 in
https://gitlab.com/gitlab-org/gitlab/-/merge_requests/114641, we can
use the `--with-magic-flags` to disable this functionality outright
since this system dependency may not be safe to use.

Relates to https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/7672

Changelog: changed

Force C99 on CentOS 7 and SLES when building gitlab-rails

See merge request https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/6748



Merged-by: Robert Marshall <rmarshall@gitlab.com>
Approved-by: Jason Plum <jplum@gitlab.com>
Approved-by: Robert Marshall <rmarshall@gitlab.com>
Reviewed-by: Balasankar 'Balu' C <balasankar@gitlab.com>
Co-authored-by: Balasankar "Balu" C <balasankar@gitlab.com>

Use C99 when compiling rubymagic on CentOS 7 and SLES.

Signed-off-by: Balasankar "Balu" C <balasankar@gitlab.com>

Add more detail related to Geo primary role

See merge request https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/6735



Merged-by: Achilleas Pipinellis <axil@gitlab.com>
Approved-by: Achilleas Pipinellis <axil@gitlab.com>
Reviewed-by: Michael Kozono <mkozono@gitlab.com>
Reviewed-by: Sampath Ranasinghe <sranasinghe@gitlab.com>
Co-authored-by: Michael Kozono <mkozono@gitlab.com>
Co-authored-by: Sampath Ranasinghe <sranasinghe@gitlab.com>