[{"data":1,"prerenderedAt":1134},["ShallowReactive",2],{"/blog/rise-of-protestware":3,"navigation-en-us":351,"banner-en-us":779,"footer-en-us":789,"blog-post-authors-en-us-Abubakar Siddiq Ango":1031,"blog-related-posts-en-us-rise-of-protestware":1046,"blog-promotions-en-us":1071,"next-steps-en-us":1124},{"id":4,"title":5,"authors":6,"body":8,"category":329,"date":330,"description":331,"extension":332,"externalUrl":333,"faq":333,"featured":334,"heroImage":335,"meta":336,"navigation":137,"path":337,"seo":338,"slug":342,"stem":343,"tags":344,"template":349,"updatedDate":333,"__hash__":350},"blogPosts/en-us/blog/rise-of-protestware.md","Protestware threats: How to protect your software supply chain",[7],"Abubakar Siddiq Ango",{"type":9,"value":10,"toc":323},"minimark",[11,28,54,57,60,65,110,152,173,180,184,222,225,238,242,256,260,275,278,285,292,300,307,316,319],[12,13,14,15,21,22,27],"p",{},"In 2016, the continuous integration (CI) pipelines of millions of projects failed because a developer decided to pull their projects from npm package registry in ",[16,17,20],"a",{"href":18,"rel":19},"https://www.theregister.com/2016/03/23/npm_left_pad_chaos/",[],"protest of a request to take down or rename one of their packages",". In January 2022, the maintainer of the widely used 'colors' and 'faker' packages on the npm registry modified ",[16,23,26],{"href":24,"rel":25},"https://blog.sonatype.com/npm-libraries-colors-and-faker-sabotaged-in-protest-by-their-maintainer-what-to-do-now?hsLang=en-us",[],"these projects",", adding malicious code that infinitely printed gibberish in protest of corporations who use open source projects without giving back. These are two examples of \"protestware,\" a term that refers to software packages or applications that have been intentionally modified to send a political message. The impacts may range from seeing unexpected messages in a terminal or logs when building an application to serious adverse impacts like data deletion.",[12,29,30,31,36,37,42,43,48,49,53],{},"While protestware remained rare for a long time, recent high-profile incidents have brought it back into the spotlight. Similar code injection variants like ",[16,32,35],{"href":33,"rel":34},"https://www.kaspersky.com/resource-center/definitions/what-is-typosquatting",[],"typosquatting"," packages (as in the case of the ",[16,38,41],{"href":39,"rel":40},"https://www.mend.io/resources/blog/new-typosquating-attack-on-npm-package-colors-using-cross-language-technique-explained/",[],"colors npm"," package, where bad actors created compromised clones of packages with similar names) and compromised packages (as in the case of the ",[16,44,47],{"href":45,"rel":46},"https://www.theregister.com/2022/05/24/pypi_ctx_package_compromised/",[],"ctx PyPI packages",") are usually perpetrated by bad actors looking to cause harm. Protestware is unusual in that the custodians of projects trusted by the community have allowed or made these changes. Regardless of whether the changes' impacts are harmful, such changes raise ethical concerns and can create unwanted distractions. These risks also reinforce the need for open source consumers to adopt a ",[16,50,52],{"href":51},"/blog/why-devops-and-zero-trust-go-together/","zero trust security model"," for their software supply chain. Trust, but verify!",[12,55,56],{},"The world is going through unprecedented movements demanding change, and change seekers will find new and often disruptive ways to be heard, as we have seen in the case of everything from climate activism to TikTok challenges. Software supply chains are not exempt and, as we have learned from past incidents, being proactive is key to staying secure.",[12,58,59],{},"Here are some steps you can take to protect your software supply chain by ensuring your dependencies are secure.",[61,62,64],"h2",{"id":63},"implement-dependency-scanning","Implement dependency scanning",[12,66,67,72,73,81,82,87,88,93,94,99,100,103,104,109],{},[16,68,71],{"href":69,"rel":70},"https://docs.gitlab.com/user/application_security/dependency_scanning/",[],"Dependency scanning"," is now an industry standard, and there is no shortage of tools or libraries to scan your packages, containers, or any other binary formats for vulnerabilities. Using GitLab CI’s ",[16,74,77],{"href":75,"rel":76},"https://docs.gitlab.com/ci/yaml/#rulesexists",[],[78,79,80],"code",{},"rules:exists"," rule, GitLab checks for the presence of certain files to determine the appropriate scans to check for vulnerabilities. Coupled with ",[16,83,86],{"href":84,"rel":85},"https://docs.gitlab.com/user/application_security/vulnerability_report/",[],"Vulnerability Reports",", ",[16,89,92],{"href":90,"rel":91},"https://docs.gitlab.com/user/application_security/policies/#policy-management",[],"Policy Management",", and the ",[16,95,98],{"href":96,"rel":97},"https://docs.gitlab.com/user/application_security/security_dashboard/",[],"Security Dashboard",", your security team and organization can stay ahead of vulnerabilities. To include dependency scanning in your CI pipeline, add the following lines to your ",[78,101,102],{},".gitlab-ci.yml"," file. You can explore the ",[16,105,108],{"href":106,"rel":107},"https://gitlab.com/gitlab-org/gitlab/-/blob/master/lib/gitlab/ci/templates/Jobs/Dependency-Scanning.gitlab-ci.yml",[],"Dependency Scanning CI template"," to understand how it works.",[111,112,117],"pre",{"className":113,"code":114,"language":115,"meta":116,"style":116},"language-yaml shiki shiki-themes github-light","include:\n\n  template: Jobs/Dependency-Scanning.gitlab-ci.yml\n\n","yaml","",[78,118,119,132,139],{"__ignoreMap":116},[120,121,124,128],"span",{"class":122,"line":123},"line",1,[120,125,127],{"class":126},"shJU0","include",[120,129,131],{"class":130},"sgsFI",":\n",[120,133,135],{"class":122,"line":134},2,[120,136,138],{"emptyLinePlaceholder":137},true,"\n",[120,140,142,145,148],{"class":122,"line":141},3,[120,143,144],{"class":126},"  template",[120,146,147],{"class":130},": ",[120,149,151],{"class":150},"sYBdl","Jobs/Dependency-Scanning.gitlab-ci.yml\n",[12,153,154,155,160,161,166,167,172],{},"Running the CI script against an example ",[16,156,159],{"href":157,"rel":158},"https://gitlab.com/gitlab-da/playground/ruby-rails-demo",[],"Ruby on Rails project"," with Ruby 3.0.4, the ",[16,162,165],{"href":163,"rel":164},"https://gitlab.com/gitlab-da/playground/ruby-rails-demo/-/security/vulnerability_report/?scanner=GitLab.DEPENDENCY_SCANNING",[],"Vulnerability Report"," shows more than 70 vulnerabilities detected for the dependencies in the project’s ",[16,168,171],{"href":169,"rel":170},"https://gitlab.com/gitlab-da/playground/ruby-rails-demo/-/blob/master/Gemfile",[],"Gemfile",".",[12,174,175],{},[176,177],"img",{"alt":178,"src":179,"title":178},"Vulnerability Report Image","https://res.cloudinary.com/about-gitlab-com/image/upload/v1782397771/blog/Content%20Images/2023-04-rise-of-protestware/vulnerability-report.png",[61,181,183],{"id":182},"generate-provenance-validations","Generate provenance validations",[12,185,186,187,192,193,198,199,204,205,210,211,215,216,221],{},"Users of packages can verify they are not downloading a compromised version using ",[16,188,191],{"href":189,"rel":190},"https://docs.gitlab.com/ci/runners/configure_runners/#artifact-attestation",[],"artifact attestation",", which was ",[16,194,197],{"href":195,"rel":196},"https://gitlab.com/gitlab-org/gitlab-runner/-/issues/28940/",[],"introduced in GitLab Runner 15.1",". Attestation metadata is generated in the ",[16,200,203],{"href":201,"rel":202},"https://github.com/in-toto/attestation",[],"in-toto format","; it provides ",[16,206,209],{"href":207,"rel":208},"https://slsa.dev/provenance/v0.2",[],"provenance"," attesting to how a binary was built, and you can verify the artifacts against the provenance. This allows you to achieve ",[16,212,214],{"href":213},"/blog/achieve-slsa-level-2-compliance-with-gitlab/","Level 2"," of the Supply-chain Levels for Software Artifacts (",[16,217,220],{"href":218,"rel":219},"https://slsa.dev/",[],"SLSA",") security framework.",[12,223,224],{},"The demo video below shows how to configure your CI script to generate artifact attestation metadata.",[226,227,230,231],"figure",{"className":228},[229],"video_container","\n  ",[232,233,237],"iframe",{"src":234,"frameBorder":235,"allowFullScreen":236},"https://www.youtube.com/embed/MlIdqrDgI8U","0","true"," ",[61,239,241],{"id":240},"utilize-private-registries","Utilize private registries",[12,243,244,249,250,255],{},[16,245,248],{"href":246,"rel":247},"https://docs.gitlab.com/user/packages/",[],"Self-hosting registries"," for packages, container images, or your Terraform modules are a more secure way of ensuring secure and vetted packages are used by your team. Security and compliance teams are enabled to ensure total control of the dependencies used in the entire organization and how they are accessed with ",[16,251,254],{"href":252,"rel":253},"https://docs.gitlab.com/user/packages/package_registry/#package-registry-visibility-permissions",[],"package registry permissions",". GitLab supports container, infrastructure, and package registries. Package registries supported include Composer (PHP), Conan (C/C++), Generic, Maven (Java), npm (NodeJS), NuGet (Windows packaging), PyPI (Python), and RubyGems (Ruby).",[61,257,259],{"id":258},"enable-dependency-proxy","Enable Dependency Proxy",[12,261,262,263,268,269,274],{},"The ",[16,264,267],{"href":265,"rel":266},"https://docs.gitlab.com/user/packages/dependency_proxy/",[],"Dependency Proxy"," reduces the number of requests made to upstream dependency registries by acting as a local proxy. This reduces the impact of changes or vulnerabilities in the upstream packages, as a clean version will still be stored in the Dependency Proxy’s cache. This offers faster build times, since the cache is most likely closer to the build system that needs the image, and it ensures continuity when an upstream registry is having downtime or enforcing rate limits — as in the case of ",[16,270,273],{"href":271,"rel":272},"https://docs.docker.com/docker-hub/download-rate-limit/",[],"Docker Hub",", which has a limit of 100 container image pulls per 6 hours per IP address container image for anynomous users as of the time of writing this article.",[12,276,277],{},"You can enable Dependency Proxy in the Packages and Registries section of a group’s settings. Only an administrator can enable/disable the Dependency Proxy for a GitLab instance.",[12,279,280],{},[176,281],{"alt":282,"src":283,"title":284},"Dependency Proxy setting image","https://res.cloudinary.com/about-gitlab-com/image/upload/v1782397770/blog/Content%20Images/2023-04-rise-of-protestware/dependency-proxy.png","Dependency Proxy Setting Image",[12,286,287,288,291],{},"To use the Dependency Proxy in your CI script, you can use the ",[78,289,290],{},"CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX"," predefined variable as shown below:",[111,293,298],{"className":294,"code":296,"language":297,"meta":116},[295],"language-text","# .gitlab-ci.yml\n\nimage: ${CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX}/ubuntu:latest\n","text",[78,299,296],{"__ignoreMap":116},[12,301,302,303,172],{},"The GitLab Runner automatically authenticates with the Dependency Proxy, but if your use case requires manual authentication, like building container images, you can use other predefined CI/CD variables as detailed in the ",[16,304,306],{"href":265,"rel":305},[],"documentation",[12,308,309,310,315],{},"GitLab is also working on leveraging the Dependency Proxy to give more control to security teams with the ",[16,311,314],{"href":312,"rel":313},"https://docs.gitlab.com/user/packages/package_registry/dependency_proxy/",[],"Dependency Firewall",", which will allow for control of how upstream packages are used and how they impact the organization. Package validation and version management can be managed from a central location without impacting the workflow of users.",[12,317,318],{},"Proactively instrumenting your software development lifecycle to ensure continuous review of your application along with controls is critical to keeping your software supply chain secure and preventing production problems due to protestware.",[320,321,322],"style",{},"html pre.shiki code .shJU0, html code.shiki .shJU0{--shiki-default:#22863A}html pre.shiki code .sgsFI, html code.shiki .sgsFI{--shiki-default:#24292E}html pre.shiki code .sYBdl, html code.shiki .sYBdl{--shiki-default:#032F62}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":116,"searchDepth":134,"depth":134,"links":324},[325,326,327,328],{"id":63,"depth":134,"text":64},{"id":182,"depth":134,"text":183},{"id":240,"depth":134,"text":241},{"id":258,"depth":134,"text":259},"devsecops","2023-05-09","Some people protest for change by changing code others depend on throughout the software supply chain. Learn more about protestware, its impact, and how to protect against it.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749669673/Blog/Hero%20Images/engineering.png",{},"/en-us/blog/rise-of-protestware",{"title":5,"description":331,"ogTitle":5,"ogDescription":331,"noIndex":334,"ogImage":335,"ogUrl":339,"ogSiteName":340,"ogType":341,"canonicalUrls":339},"https://about.gitlab.com/blog/rise-of-protestware","https://about.gitlab.com","article","rise-of-protestware","en-us/blog/rise-of-protestware",[345,346,347,348],"DevSecOps","zero trust","security","DevSecOps platform","BlogPost","R2XNWvDLMIaBq1gns-N6u-jAjSJEQ2qa4LY42wjty-o",{"logo":352,"freeTrial":357,"sales":362,"login":367,"items":372,"search":699,"minimal":730,"duo":749,"switchNav":758,"pricingDeployment":769},{"config":353},{"href":354,"dataGaName":355,"dataGaLocation":356},"/","gitlab logo","header",{"text":358,"config":359},"Get free trial",{"href":360,"dataGaName":361,"dataGaLocation":356},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":363,"config":364},"Request a demo",{"href":365,"dataGaName":366,"dataGaLocation":356},"/sales/?contact-topic=request-demo","sales",{"text":368,"config":369},"Sign in",{"href":370,"dataGaName":371,"dataGaLocation":356},"https://gitlab.com/users/sign_in/","sign in",[373,402,502,507,621,677],{"text":374,"config":375,"menu":377},"Platform",{"dataNavLevelOne":376},"platform",{"type":378,"columns":379},"cards",[380,386,394],{"title":374,"description":381,"link":382},"The intelligent orchestration platform for DevSecOps",{"text":383,"config":384},"Explore our Platform",{"href":385,"dataGaName":376,"dataGaLocation":356},"/platform/",{"title":387,"description":388,"link":389},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":390,"config":391},"Meet GitLab Duo",{"href":392,"dataGaName":393,"dataGaLocation":356},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":395,"description":396,"link":397},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":398,"config":399},"Learn more",{"href":400,"dataGaName":401,"dataGaLocation":356},"/why-gitlab/","why gitlab",{"text":403,"left":137,"config":404,"menu":406},"Product",{"dataNavLevelOne":405},"solutions",{"type":407,"link":408,"columns":412,"feature":481},"lists",{"text":409,"config":410},"View all Solutions",{"href":411,"dataGaName":405,"dataGaLocation":356},"/solutions/",[413,437,460],{"title":414,"description":415,"link":416,"items":421},"Automation","CI/CD and automation to accelerate deployment",{"config":417},{"icon":418,"href":419,"dataGaName":420,"dataGaLocation":356},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[422,426,429,433],{"text":423,"config":424},"CI/CD",{"href":425,"dataGaLocation":356,"dataGaName":423},"/solutions/continuous-integration/",{"text":387,"config":427},{"href":392,"dataGaLocation":356,"dataGaName":428},"gitlab duo agent platform - product menu",{"text":430,"config":431},"Source Code Management",{"href":432,"dataGaLocation":356,"dataGaName":430},"/solutions/source-code-management/",{"text":434,"config":435},"Automated Software Delivery",{"href":419,"dataGaLocation":356,"dataGaName":436},"Automated software delivery",{"title":438,"description":439,"link":440,"items":445},"Security","Deliver code faster without compromising security",{"config":441},{"href":442,"dataGaName":443,"dataGaLocation":356,"icon":444},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[446,450,455],{"text":447,"config":448},"Application Security Testing",{"href":442,"dataGaName":449,"dataGaLocation":356},"Application security testing",{"text":451,"config":452},"Software Supply Chain Security",{"href":453,"dataGaLocation":356,"dataGaName":454},"/solutions/supply-chain/","Software supply chain security",{"text":456,"config":457},"Software Compliance",{"href":458,"dataGaName":459,"dataGaLocation":356},"/solutions/software-compliance/","software compliance",{"title":461,"link":462,"items":467},"Measurement",{"config":463},{"icon":464,"href":465,"dataGaName":466,"dataGaLocation":356},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[468,472,476],{"text":469,"config":470},"Visibility & Measurement",{"href":465,"dataGaLocation":356,"dataGaName":471},"Visibility and Measurement",{"text":473,"config":474},"Value Stream Management",{"href":475,"dataGaLocation":356,"dataGaName":473},"/solutions/value-stream-management/",{"text":477,"config":478},"Analytics & Insights",{"href":479,"dataGaLocation":356,"dataGaName":480},"/solutions/analytics-and-insights/","Analytics and insights",{"title":482,"type":407,"items":483},"GitLab for",[484,490,496],{"text":485,"config":486},"Enterprise",{"icon":487,"href":488,"dataGaLocation":356,"dataGaName":489},"Building","/enterprise/","enterprise",{"text":491,"config":492},"Small Business",{"icon":493,"href":494,"dataGaLocation":356,"dataGaName":495},"Work","/small-business/","small business",{"text":497,"config":498},"Public Sector",{"icon":499,"href":500,"dataGaLocation":356,"dataGaName":501},"Organization","/solutions/public-sector/","public sector",{"text":503,"config":504},"Pricing",{"href":505,"dataGaName":506,"dataGaLocation":356,"dataNavLevelOne":506},"/pricing/","pricing",{"text":508,"config":509,"menu":511},"Resources",{"dataNavLevelOne":510},"resources",{"type":407,"link":512,"columns":516,"feature":610},{"text":513,"config":514},"View all resources",{"href":515,"dataGaName":510,"dataGaLocation":356},"/resources/",[517,550,577],{"title":518,"items":519},"Getting started",[520,525,530,535,540,545],{"text":521,"config":522},"Install",{"href":523,"dataGaName":524,"dataGaLocation":356},"/install/","install",{"text":526,"config":527},"Quick start guides",{"href":528,"dataGaName":529,"dataGaLocation":356},"/get-started/","quick setup checklists",{"text":531,"config":532},"Learn",{"href":533,"dataGaLocation":356,"dataGaName":534},"https://university.gitlab.com/","learn",{"text":536,"config":537},"Product documentation",{"href":538,"dataGaName":539,"dataGaLocation":356},"https://docs.gitlab.com/","product documentation",{"text":541,"config":542},"Best practice videos",{"href":543,"dataGaName":544,"dataGaLocation":356},"/getting-started-videos/","best practice videos",{"text":546,"config":547},"Integrations",{"href":548,"dataGaName":549,"dataGaLocation":356},"/integrations/","integrations",{"title":551,"items":552},"Discover",[553,558,563,568,572],{"text":554,"config":555},"Customer success stories",{"href":556,"dataGaName":557,"dataGaLocation":356},"/customers/","customer success stories",{"text":559,"config":560},"Blog",{"href":561,"dataGaName":562,"dataGaLocation":356},"/blog/","blog",{"text":564,"config":565},"Demo Hub",{"href":566,"dataGaName":567,"dataGaLocation":356},"/demo-hub/","demo hub",{"text":569,"config":570},"The Source",{"href":571,"dataGaName":562,"dataGaLocation":356},"/the-source/",{"text":573,"config":574},"Remote",{"href":575,"dataGaName":576,"dataGaLocation":356},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":578,"items":579},"Connect",[580,585,590,595,600,605],{"text":581,"config":582},"GitLab Services",{"href":583,"dataGaName":584,"dataGaLocation":356},"/services/","services",{"text":586,"config":587},"Contribute",{"href":588,"dataGaName":589,"dataGaLocation":356},"https://contributors.gitlab.com","contribute",{"text":591,"config":592},"Community",{"href":593,"dataGaName":594,"dataGaLocation":356},"/community/","community",{"text":596,"config":597},"Forum",{"href":598,"dataGaName":599,"dataGaLocation":356},"https://forum.gitlab.com/","forum",{"text":601,"config":602},"Events",{"href":603,"dataGaName":604,"dataGaLocation":356},"/events/","events",{"text":606,"config":607},"Partners",{"href":608,"dataGaName":609,"dataGaLocation":356},"/partners/","partners",{"config":611,"title":614,"text":615,"link":616},{"background":612,"textColor":613},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":617,"config":618},"Read the latest",{"href":619,"dataGaName":620,"dataGaLocation":356},"/whats-new/","whats new",{"text":622,"config":623,"menu":625},"Company",{"dataNavLevelOne":624},"company",{"type":407,"columns":626},[627],{"items":628},[629,634,640,642,647,652,657,662,667,672],{"text":630,"config":631},"About",{"href":632,"dataGaName":633,"dataGaLocation":356},"/company/","about",{"text":635,"config":636,"footerGa":639},"Jobs",{"href":637,"dataGaName":638,"dataGaLocation":356},"/jobs/","jobs",{"dataGaName":638},{"text":601,"config":641},{"href":603,"dataGaName":604,"dataGaLocation":356},{"text":643,"config":644},"Leadership",{"href":645,"dataGaName":646,"dataGaLocation":356},"/company/team/e-group/","leadership",{"text":648,"config":649},"Handbook",{"href":650,"dataGaName":651,"dataGaLocation":356},"https://handbook.gitlab.com/","handbook",{"text":653,"config":654},"Investor relations",{"href":655,"dataGaName":656,"dataGaLocation":356},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":658,"config":659},"Trust Center",{"href":660,"dataGaName":661,"dataGaLocation":356},"/security/","trust center",{"text":663,"config":664},"AI Transparency Center",{"href":665,"dataGaName":666,"dataGaLocation":356},"/ai-transparency-center/","ai transparency center",{"text":668,"config":669},"Newsletter",{"href":670,"dataGaName":671,"dataGaLocation":356},"/company/contact/#contact-forms","newsletter",{"text":673,"config":674},"Press",{"href":675,"dataGaName":676,"dataGaLocation":356},"/press/","press",{"text":678,"config":679,"menu":680},"Contact us",{"dataNavLevelOne":624},{"type":407,"columns":681},[682],{"items":683},[684,689,694],{"text":685,"config":686},"Talk to sales",{"href":687,"dataGaName":688,"dataGaLocation":356},"/sales/","talk to sales",{"text":690,"config":691},"Support portal",{"href":692,"dataGaName":693,"dataGaLocation":356},"https://support.gitlab.com/hc/en-us","support portal",{"text":695,"config":696},"Customer portal",{"href":697,"dataGaName":698,"dataGaLocation":356},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":700,"login":701,"suggestions":708},"Close",{"text":702,"link":703},"To search repositories and projects, login to",{"text":704,"config":705},"gitlab.com",{"href":370,"dataGaName":706,"dataGaLocation":707},"search login","search",{"text":709,"default":710},"Suggestions",[711,713,717,719,723,727],{"text":387,"config":712},{"href":392,"dataGaName":387,"dataGaLocation":707},{"text":714,"config":715},"Code Suggestions (AI)",{"href":716,"dataGaName":714,"dataGaLocation":707},"/solutions/code-suggestions/",{"text":423,"config":718},{"href":425,"dataGaName":423,"dataGaLocation":707},{"text":720,"config":721},"GitLab on AWS",{"href":722,"dataGaName":720,"dataGaLocation":707},"/partners/technology-partners/aws/",{"text":724,"config":725},"GitLab on Google Cloud",{"href":726,"dataGaName":724,"dataGaLocation":707},"/partners/technology-partners/google-cloud-platform/",{"text":728,"config":729},"Why GitLab?",{"href":400,"dataGaName":728,"dataGaLocation":707},{"freeTrial":731,"mobileIcon":736,"desktopIcon":741,"secondaryButton":744},{"text":732,"config":733},"Start free trial",{"href":734,"dataGaName":361,"dataGaLocation":735},"https://gitlab.com/-/trials/new/","nav",{"altText":737,"config":738},"Gitlab Icon",{"src":739,"dataGaName":740,"dataGaLocation":735},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":737,"config":742},{"src":743,"dataGaName":740,"dataGaLocation":735},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":745,"config":746},"Get Started",{"href":747,"dataGaName":748,"dataGaLocation":735},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":750,"mobileIcon":754,"desktopIcon":756},{"text":751,"config":752},"Learn more about GitLab Duo",{"href":392,"dataGaName":753,"dataGaLocation":735},"gitlab duo",{"altText":737,"config":755},{"src":739,"dataGaName":740,"dataGaLocation":735},{"altText":737,"config":757},{"src":743,"dataGaName":740,"dataGaLocation":735},{"button":759,"mobileIcon":764,"desktopIcon":766},{"text":760,"config":761},"/switch",{"href":762,"dataGaName":763,"dataGaLocation":735},"#contact","switch",{"altText":737,"config":765},{"src":739,"dataGaName":740,"dataGaLocation":735},{"altText":737,"config":767},{"src":768,"dataGaName":740,"dataGaLocation":735},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":770,"mobileIcon":775,"desktopIcon":777},{"text":771,"config":772},"Back to pricing",{"href":505,"dataGaName":773,"dataGaLocation":735,"icon":774},"back to pricing","GoBack",{"altText":737,"config":776},{"src":739,"dataGaName":740,"dataGaLocation":735},{"altText":737,"config":778},{"src":743,"dataGaName":740,"dataGaLocation":735},{"title":780,"titleMobile":781,"button":782,"config":787},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":398,"config":783},{"href":784,"dataGaName":785,"dataGaLocation":786},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":788,"disabled":334},"release",{"data":790},{"text":791,"source":792,"edit":798,"contribute":803,"config":808,"items":813,"minimal":1020},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":793,"config":794},"View page source",{"href":795,"dataGaName":796,"dataGaLocation":797},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":799,"config":800},"Edit this page",{"href":801,"dataGaName":802,"dataGaLocation":797},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":804,"config":805},"Please contribute",{"href":806,"dataGaName":807,"dataGaLocation":797},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":809,"facebook":810,"youtube":811,"linkedin":812},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[814,861,912,956,988],{"title":503,"links":815,"subMenu":830},[816,820,825],{"text":817,"config":818},"View plans",{"href":505,"dataGaName":819,"dataGaLocation":797},"view plans",{"text":821,"config":822},"Why Premium?",{"href":823,"dataGaName":824,"dataGaLocation":797},"/pricing/premium/","why premium",{"text":826,"config":827},"Why Ultimate?",{"href":828,"dataGaName":829,"dataGaLocation":797},"/pricing/ultimate/","why ultimate",[831],{"title":832,"links":833},"Contact Us",[834,837,839,841,846,851,856],{"text":835,"config":836},"Contact sales",{"href":687,"dataGaName":366,"dataGaLocation":797},{"text":690,"config":838},{"href":692,"dataGaName":693,"dataGaLocation":797},{"text":695,"config":840},{"href":697,"dataGaName":698,"dataGaLocation":797},{"text":842,"config":843},"Status",{"href":844,"dataGaName":845,"dataGaLocation":797},"https://status.gitlab.com/","status",{"text":847,"config":848},"Terms of use",{"href":849,"dataGaName":850,"dataGaLocation":797},"/terms/","terms of use",{"text":852,"config":853},"Privacy statement",{"href":854,"dataGaName":855,"dataGaLocation":797},"/privacy/","privacy statement",{"text":857,"config":858},"Cookie preferences",{"dataGaName":859,"dataGaLocation":797,"id":860,"isOneTrustButton":137},"cookie preferences","ot-sdk-btn",{"title":403,"links":862,"subMenu":870},[863,866],{"text":348,"config":864},{"href":385,"dataGaName":865,"dataGaLocation":797},"devsecops platform",{"text":867,"config":868},"AI-Assisted Development",{"href":392,"dataGaName":869,"dataGaLocation":797},"ai-assisted development",[871],{"title":872,"links":873},"Topics",[874,879,884,889,894,897,902,907],{"text":875,"config":876},"CICD",{"href":877,"dataGaName":878,"dataGaLocation":797},"/topics/ci-cd/","cicd",{"text":880,"config":881},"GitOps",{"href":882,"dataGaName":883,"dataGaLocation":797},"/topics/gitops/","gitops",{"text":885,"config":886},"DevOps",{"href":887,"dataGaName":888,"dataGaLocation":797},"/topics/devops/","devops",{"text":890,"config":891},"Version Control",{"href":892,"dataGaName":893,"dataGaLocation":797},"/topics/version-control/","version control",{"text":345,"config":895},{"href":896,"dataGaName":329,"dataGaLocation":797},"/topics/devsecops/",{"text":898,"config":899},"Cloud Native",{"href":900,"dataGaName":901,"dataGaLocation":797},"/topics/cloud-native/","cloud native",{"text":903,"config":904},"AI for Coding",{"href":905,"dataGaName":906,"dataGaLocation":797},"/topics/devops/ai-for-coding/","ai for coding",{"text":908,"config":909},"Agentic AI",{"href":910,"dataGaName":911,"dataGaLocation":797},"/topics/agentic-ai/","agentic ai",{"title":913,"links":914},"Solutions",[915,917,919,924,928,931,935,938,940,943,946,951],{"text":447,"config":916},{"href":442,"dataGaName":447,"dataGaLocation":797},{"text":436,"config":918},{"href":419,"dataGaName":420,"dataGaLocation":797},{"text":920,"config":921},"Agile development",{"href":922,"dataGaName":923,"dataGaLocation":797},"/solutions/agile-delivery/","agile delivery",{"text":925,"config":926},"SCM",{"href":432,"dataGaName":927,"dataGaLocation":797},"source code management",{"text":875,"config":929},{"href":425,"dataGaName":930,"dataGaLocation":797},"continuous integration & delivery",{"text":932,"config":933},"Value stream management",{"href":475,"dataGaName":934,"dataGaLocation":797},"value stream management",{"text":880,"config":936},{"href":937,"dataGaName":883,"dataGaLocation":797},"/solutions/gitops/",{"text":485,"config":939},{"href":488,"dataGaName":489,"dataGaLocation":797},{"text":941,"config":942},"Small business",{"href":494,"dataGaName":495,"dataGaLocation":797},{"text":944,"config":945},"Public sector",{"href":500,"dataGaName":501,"dataGaLocation":797},{"text":947,"config":948},"Education",{"href":949,"dataGaName":950,"dataGaLocation":797},"/solutions/education/","education",{"text":952,"config":953},"Financial services",{"href":954,"dataGaName":955,"dataGaLocation":797},"/solutions/finance/","financial services",{"title":508,"links":957},[958,960,962,964,967,969,972,974,976,978,980,982,984,986],{"text":521,"config":959},{"href":523,"dataGaName":524,"dataGaLocation":797},{"text":526,"config":961},{"href":528,"dataGaName":529,"dataGaLocation":797},{"text":531,"config":963},{"href":533,"dataGaName":534,"dataGaLocation":797},{"text":536,"config":965},{"href":538,"dataGaName":966,"dataGaLocation":797},"docs",{"text":559,"config":968},{"href":561,"dataGaName":562,"dataGaLocation":797},{"text":970,"config":971},"What's new",{"href":619,"dataGaName":620,"dataGaLocation":797},{"text":554,"config":973},{"href":556,"dataGaName":557,"dataGaLocation":797},{"text":573,"config":975},{"href":575,"dataGaName":576,"dataGaLocation":797},{"text":581,"config":977},{"href":583,"dataGaName":584,"dataGaLocation":797},{"text":586,"config":979},{"href":588,"dataGaName":589,"dataGaLocation":797},{"text":591,"config":981},{"href":593,"dataGaName":594,"dataGaLocation":797},{"text":596,"config":983},{"href":598,"dataGaName":599,"dataGaLocation":797},{"text":601,"config":985},{"href":603,"dataGaName":604,"dataGaLocation":797},{"text":606,"config":987},{"href":608,"dataGaName":609,"dataGaLocation":797},{"title":622,"links":989},[990,992,994,996,998,1000,1004,1009,1011,1013,1015],{"text":630,"config":991},{"href":632,"dataGaName":624,"dataGaLocation":797},{"text":635,"config":993},{"href":637,"dataGaName":638,"dataGaLocation":797},{"text":643,"config":995},{"href":645,"dataGaName":646,"dataGaLocation":797},{"text":648,"config":997},{"href":650,"dataGaName":651,"dataGaLocation":797},{"text":653,"config":999},{"href":655,"dataGaName":656,"dataGaLocation":797},{"text":1001,"config":1002},"Sustainability",{"href":1003,"dataGaName":1001,"dataGaLocation":797},"/sustainability/",{"text":1005,"config":1006},"Diversity, inclusion and belonging (DIB)",{"href":1007,"dataGaName":1008,"dataGaLocation":797},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":658,"config":1010},{"href":660,"dataGaName":661,"dataGaLocation":797},{"text":668,"config":1012},{"href":670,"dataGaName":671,"dataGaLocation":797},{"text":673,"config":1014},{"href":675,"dataGaName":676,"dataGaLocation":797},{"text":1016,"config":1017},"Modern Slavery Transparency Statement",{"href":1018,"dataGaName":1019,"dataGaLocation":797},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":1021},[1022,1025,1028],{"text":1023,"config":1024},"Terms",{"href":849,"dataGaName":850,"dataGaLocation":797},{"text":1026,"config":1027},"Cookies",{"dataGaName":859,"dataGaLocation":797,"id":860,"isOneTrustButton":137},{"text":1029,"config":1030},"Privacy",{"href":854,"dataGaName":855,"dataGaLocation":797},[1032],{"id":1033,"title":7,"body":333,"config":1034,"content":1036,"description":333,"extension":1040,"meta":1041,"navigation":137,"path":1042,"seo":1043,"stem":1044,"__hash__":1045},"blogAuthors/en-us/blog/authors/abubakar-siddiq-ango.yml",{"template":1035},"BlogAuthor",{"name":7,"config":1037},{"headshot":1038,"ctfId":1039},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749660104/Blog/Author%20Headshots/abuango-headshot.jpg","abuango","yml",{},"/en-us/blog/authors/abubakar-siddiq-ango",{},"en-us/blog/authors/abubakar-siddiq-ango","u5Jv4JxCpfmcGQuXEU4Lr5xVBJP9LAB2NkXRMLeYwPE",[1047,1055,1063],{"title":1048,"description":1049,"heroImage":1050,"category":329,"date":1051,"authors":1052,"slug":1054,"externalUrl":333},"Consolidate your GitLab stack with Gitaly on Kubernetes","Discover how to install Gitaly on Kubernetes, which is now generally available.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756500636/wmey6kqzzuhirk88w2de.png","2026-05-07",[1053],"Olivier Campeau","gitaly-on-kubernetes-generally-available",{"title":1056,"description":1057,"heroImage":1058,"category":329,"date":1059,"authors":1060,"slug":1062,"externalUrl":333},"Teaching software development the easy way using GitLab","Learn how University of Washington lecturer Stephen G. Dame uses GitLab for Education to manage student assignments, distribute course materials, and provide inline code feedback at scale.\n","https://res.cloudinary.com/about-gitlab-com/image/upload/v1749659537/Blog/Hero%20Images/display-article-image-0679-1800x945-fy26.png","2026-04-29",[1061],"Rod Burns","teaching-software-development-the-easy-way-using-gitlab",{"title":1064,"description":1065,"heroImage":1066,"category":329,"date":1067,"authors":1068,"slug":1070,"externalUrl":333},"AI is reshaping DevSecOps: Attend GitLab Transcend to see what’s next","AI-generated code is 34% of development work. Discover how to balance productivity gains with quality, reliability, and security.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1767982271/e9ogyosmuummq7j65zqg.png","2026-01-08",[1069],"Manav Khurana","ai-is-reshaping-devsecops-attend-gitlab-transcend-to-see-whats-next",{"promotions":1072},[1073,1087,1099,1110],{"id":1074,"categories":1075,"header":1077,"text":1078,"button":1079,"image":1084},"ai-modernization",[1076],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":1080,"config":1081},"Get your AI maturity score",{"href":1082,"dataGaName":1083,"dataGaLocation":562},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":1085},{"src":1086},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":1088,"categories":1089,"header":1091,"text":1078,"button":1092,"image":1096},"devops-modernization",[1090,329],"product","Are you just managing tools or shipping innovation?",{"text":1093,"config":1094},"Get your DevOps maturity score",{"href":1095,"dataGaName":1083,"dataGaLocation":562},"/assessments/devops-modernization-assessment/",{"config":1097},{"src":1098},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":1100,"categories":1101,"header":1102,"text":1078,"button":1103,"image":1107},"security-modernization",[347],"Are you trading speed for security?",{"text":1104,"config":1105},"Get your security maturity score",{"href":1106,"dataGaName":1083,"dataGaLocation":562},"/assessments/security-modernization-assessment/",{"config":1108},{"src":1109},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":1111,"paths":1112,"header":1115,"text":1116,"button":1117,"image":1122},"github-azure-migration",[1113,1114],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":1118,"config":1119},"See how GitLab compares to GitHub",{"href":1120,"dataGaName":1121,"dataGaLocation":562},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":1123},{"src":1098},{"header":1125,"blurb":1126,"button":1127,"secondaryButton":1132},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":1128,"config":1129},"Get your free trial",{"href":1130,"dataGaName":361,"dataGaLocation":1131},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":835,"config":1133},{"href":687,"dataGaName":366,"dataGaLocation":1131},1786803754352]