# HG changeset patch # User Dustin Collins <714871-dustinmm80@users.noreply.gitlab.com> # Date 1651179825 0 # Thu Apr 28 21:03:45 2022 +0000 # Node ID e4fe51b6de5e97ec67ac0f92d9f36eba4c019898 # Parent 12ba24aae50d150db2606e75d28d0c13a9744294 Remove cveignore file and references Closes https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/6733 Changelog: removed diff --git a/.cveignore b/.cveignore deleted file mode 100644 --- a/.cveignore +++ /dev/null @@ -1,46 +0,0 @@ -# ncurses/5.9 -# https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/5826 -CVE-2019-17594 -CVE-2019-17595 -CVE-2019-15547 -CVE-2019-15548 - -# libxml2/2.9.10 -# https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/5866 -CVE-2019-20388 -# https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/5867 -CVE-2020-7595 - -# libxslt/1.1.32 -# https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/5824 -CVE-2019-11068 -CVE-2019-5815 - -# bzip2/1.0.6 -# https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/5825 -CVE-2019-12900 -CVE-2016-3189 - -# unzip/6.0 -# https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/5827 -CVE-2016-9844 -CVE-2018-18384 -CVE-2019-13232 - -# gnupg/2.2.10 -CVE-2019-13050 -CVE-2018-1000858 -## https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/5211 -CVE-2019-14855 - -# openssl/1.1.1g -# Doesn't apply to omnibus-gitlab. Requires openssl version 1.1.1 or later to be used with Apache HTTP Server version 2.4.37, and -# thus for users who bring their own Apache webserver. Even so, the fix is in -# Apache httpd 2.4.38 and not openssl. Hence, ignoring. Check details in -# https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/5793#note_442221086 -CVE-2019-0190 -# False positives -CVE-2019-1543 -CVE-2017-3736 - -# Entries from CVEIGNORE variable go below this line diff --git a/.gitlab/issue_templates/Security developer workflow.md b/.gitlab/issue_templates/Security developer workflow.md --- a/.gitlab/issue_templates/Security developer workflow.md +++ b/.gitlab/issue_templates/Security developer workflow.md @@ -1,10 +1,6 @@ <!-- # Read me first! -This process is not required to remove .cveignore entries. See -https://docs.gitlab.com/omnibus/development/broken_master.html#dependency_scanning-job-failed-due-to-one-of-the-dependencies-being-reported-as-vulnerable -for more details. - Create this issue under https://gitlab.com/gitlab-org/security/omnibus-gitlab/ Set the title to: `Description of the original issue` diff --git a/doc/development/ci-variables.md b/doc/development/ci-variables.md --- a/doc/development/ci-variables.md +++ b/doc/development/ci-variables.md @@ -56,7 +56,6 @@ | OMNIBUS_GITLAB_MIRROR_PROJECT_ACCESS_TOKEN | Project access token for building a test package. | | GITLAB_QA_MIRROR_PROJECT_ACCESS_TOKEN | Project access token for triggering a downstream pipeline for end-to-end testing. | | GITLAB_BOT_MULTI_PROJECT_PIPELINE_POLLING_TOKEN (deprecated) | Trigger token for building a test package. | -| CVEIGNORE | See document on [dependencies being reported as vulnerable](broken_master.md). | | CI_SLACK_WEBHOOK_URL | Webhook URL for Slack failure notifications. | | DANGER_GITLAB_API_TOKEN | GitLab API token for dangerbot to post comments to MRs. | | DEPS_GITLAB_TOKEN | Token used by [dependencies.io](https://www.dependencies.io/gitlab-ci/) to create MRs. | diff --git a/gitlab-ci-config/gitlab-com.yml b/gitlab-ci-config/gitlab-com.yml --- a/gitlab-ci-config/gitlab-com.yml +++ b/gitlab-ci-config/gitlab-com.yml @@ -664,7 +664,6 @@ dependency_scanning: gl-dependency-scanning-report.json paths: - dependency_report.txt - - .cveignore dependency_update: image: "${BUILDER_IMAGE_REGISTRY}/ruby_docker:${BUILDER_IMAGE_REVISION}"