Skip to content
Snippets Groups Projects
  1. Feb 24, 2023
  2. Dec 13, 2022
  3. Dec 02, 2022
  4. Nov 23, 2022
  5. Oct 07, 2022
  6. Sep 23, 2022
  7. Sep 19, 2022
    • Stan Hu's avatar
      Compile jemalloc with Ruby by default · b05a106636e7
      Stan Hu authored
      For years the Ruby interpreter has been dynamically loaded with
      jemalloc by using `LD_PRELOAD` to replace the system's malloc calls.
      While this makes it possible to disable jemalloc, some anti-virus
      scanners flag this behavior and abort the Ruby interpreter.
      
      Since jemalloc has:
      
      1. Significantly improved memory usage
      2. Is compiled with the default for Cloud Native GitLab images
      3. Is compiled with the default for all GitLab CI images
      
      We should enable by this default and deprecate the configuration
      variable.
      
      To do this, we need to install all jemalloc files, not just the
      library and binary files.
      
      We also need to pass `-Wl,--no-as-needed` as a linker argument
      due to https://bugs.ruby-lang.org/issues/18409.
      
      Relates to https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/4357
      
      Changelog: changed
      b05a106636e7
  8. Sep 15, 2022
    • Stan Hu's avatar
      Fix Ruby MD5 not always being available in FIPS mode · 7dc9ff3fd8b6
      Stan Hu authored
      If Ruby is compiled against Amazon Linux's OpenSSL v1.0.2,
      `Digest::MD5.new` fails with:
      
      ```
      md5_dgst.c(82): OpenSSL internal error, assertion failed: Digest MD5
      forbidden in FIPS mode!
      ```
      
      However, this doesn't happen on RedHat or Ubuntu FIPS because the
      OpenSSL `MD5_Init()` call isn't disabled in their OpenSSL v1.1 FIPS
      libraries. Instead, it is disabled via the `EVP_DigestInit_ex()` call,
      which is why `OpenSSL::Digest::MD5.new` fails but `Digest::MD5.new`
      works.
      
      In either case, we should just use the Ruby MD5 implementation until
      Chef completely removes the use of MD5.
      
      Relates to https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/7182
      
      Changelog: fixed
      7dc9ff3fd8b6
  9. Aug 04, 2022
  10. Aug 03, 2022
  11. Jul 15, 2022
  12. Jul 14, 2022
    • Stan Hu's avatar
      Ensure Ruby platform is set globally on ARM64 OSes · 1ea313260a88
      Stan Hu authored
      Previously Gitaly's `bundle install` installed a native gem for
      Nokogiri, even though GitLab Rails already installed the Ruby platform
      version. `bundle config set <value>`by default only sets the value
      locally, so the `force_ruby_platform` setting only affected GitLab
      Rails.
      
      Due to `rack-compiler-dock` building native gems on ARM64 with a
      Ubuntu 20.04-based image instead of `manylinux`
      (https://github.com/pypa/manylinux) as x86 builds do, ARM64 native
      gems depend on glibc v2.29. RedHat ARM64 platforms usually use an
      older version, such as v2.28 in CentOS 8.
      
      Note that Omnibus depends on a number of projects that may use native
      gems:
      
      - GitLab Rails
      - Gitaly
      - gitlab-exporter
      - MailRoom
      
      Currently only Nokogiri v1.13 appears to ship an ARM64 native
      gem. However, if some gem does the same, such as `pg`, then we'd hit
      similar issues with `gitlab-exporter`. To avoid this, set
      `force_ruby_platform` to `true` globally.
      
      Relates to https://gitlab.com/gitlab-org/gitlab/-/issues/367444
      
      Changelog: fixed
      1ea313260a88
  13. Apr 11, 2022
    • Stan Hu's avatar
      ruby: Enable OPENSSL_FIPS macro for system SSL builds · 7f6ff530c9f7
      Stan Hu authored
      In the Ubuntu 18.04 FIPS builds, currently `OpenSSL.fips_mode` is
      `false`, which prevents GitLab from entering FIPS mode.
      
      Even though these builds properly link against the FIPS-enabled system
      OpenSSL, this flag is `false` because Ruby compiles out the dynamic
      `FIPS_mode()` checks (https://wiki.openssl.org/index.php/FIPS_mode())
      unless the `OPENSSL_FIPS` macro is defined. In RedHat, `OPENSSL_FIPS`
      is always defined in `/usr/include/openssl/opensslconf-x86_64.h`, but
      this is not the case for Ubuntu. On non FIPS-systems, `FIPS_mode()`
      should return 0 (not available), so this compile-time guard should not
      be necessary. For now, we only enable it for builds that link
      against the system SSL.
      
      Relates to https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/6775
      
      Changelog: fixed
      7f6ff530c9f7
  14. Dec 20, 2021
  15. Dec 03, 2021
  16. Sep 15, 2021
  17. Sep 02, 2021
  18. Aug 17, 2021
  19. Aug 18, 2021
  20. Jul 12, 2021
  21. Jan 21, 2021
  22. Oct 08, 2020
  23. Jun 17, 2020
  24. May 18, 2020
  25. Mar 24, 2020
  26. Jan 02, 2020
  27. Jul 31, 2019
    • Ian Baum's avatar
      Upgrade rubocop to 0.73.0 · cc3bc60d8868
      Ian Baum authored
      * Add rubocop-rails and rubocop-performance gems
      * Update renamed gems in .rubocop.yml
      * Auto-correct where possible
      * Manually fix remaining gems
      cc3bc60d8868
  28. Mar 20, 2019
  29. Oct 24, 2018
  30. Oct 19, 2018
  31. Sep 05, 2018
  32. May 22, 2018
  33. Apr 12, 2018
Loading