[{"data":1,"prerenderedAt":2363},["ShallowReactive",2],{"/blog/secure-and-publish-python-packages-a-guide-to-ci-integration":3,"navigation-en-us":1583,"banner-en-us":2006,"footer-en-us":2016,"blog-post-authors-en-us-Tim Rizzi":2260,"blog-related-posts-en-us-secure-and-publish-python-packages-a-guide-to-ci-integration":2275,"blog-promotions-en-us":2300,"next-steps-en-us":2353},{"id":4,"title":5,"authors":6,"body":8,"category":1557,"date":1558,"description":1559,"extension":1560,"externalUrl":1561,"faq":1561,"featured":1152,"heroImage":1562,"meta":1563,"navigation":1152,"path":1564,"seo":1565,"slug":1570,"stem":1571,"tags":1572,"template":1581,"updatedDate":1561,"__hash__":1582},"blogPosts/en-us/blog/secure-and-publish-python-packages-a-guide-to-ci-integration.md","Secure and publish Python packages: A guide to CI integration",[7],"Tim Rizzi",{"type":9,"value":10,"toc":1541},"minimark",[11,15,18,97,101,104,131,134,137,140,160,163,166,170,173,176,190,201,204,234,237,371,374,401,405,408,411,419,422,566,569,597,601,604,607,764,767,792,796,799,920,923,944,948,951,1047,1050,1068,1072,1075,1180,1183,1206,1210,1213,1463,1466,1486,1490,1493,1496,1510,1514,1537],[12,13,14],"p",{},"Supply chain security is a critical concern in software development. Organizations need to verify the authenticity and integrity of their software packages. This guide will show you how to implement a secure CI/CD pipeline for Python packages using GitLab CI, incorporating package signing and attestation using Sigstore's Cosign.",[12,16,17],{},"You'll learn:",[19,20,21,29,35,55],"ul",{},[22,23,24],"li",{},[25,26,28],"a",{"href":27},"#why-sign-and-attest-your-python-packages%3F","Why sign and attest your Python packages?",[22,30,31],{},[25,32,34],{"href":33},"#pipeline-overview","Pipeline overview",[22,36,37,41],{},[25,38,40],{"href":39},"#complete-pipeline-implementation-setting-up-the-environment","Complete pipeline implementation: Setting up the environment",[19,42,43,49],{},[22,44,45],{},[25,46,48],{"href":47},"#environment-configuration","Environment configuration",[22,50,51],{},[25,52,54],{"href":53},"#configuration-breakdown","Configuration breakdown",[22,56,57,58],{},"The 6 stages",[59,60,61,67,73,79,85,91],"ol",{},[22,62,63],{},[25,64,66],{"href":65},"#building-crafting-the-package","Building",[22,68,69],{},[25,70,72],{"href":71},"#signing-the-digital-notarization","Signing",[22,74,75],{},[25,76,78],{"href":77},"#verification-the-security-checkpoint","Verification",[22,80,81],{},[25,82,84],{"href":83},"#publishing-the-controlled-release","Publishing",[22,86,87],{},[25,88,90],{"href":89},"#publishing-signatures-making-verification-possible","Publishing signatures",[22,92,93],{},[25,94,96],{"href":95},"#consumer-verification-testing-the-user-experience","Consumer verification",[98,99,28],"h2",{"id":100},"why-sign-and-attest-your-python-packages",[12,102,103],{},"Here are four reasons to sign and attest your Python packages:",[19,105,106,113,119,125],{},[22,107,108,112],{},[109,110,111],"strong",{},"Supply chain security:"," Package signing ensures that the code hasn't been tampered with between build and deployment, protecting against supply chain attacks.",[22,114,115,118],{},[109,116,117],{},"Compliance requirements:"," Many organizations, especially in regulated industries, require cryptographic signatures and provenance information for all deployed software.",[22,120,121,124],{},[109,122,123],{},"Traceability:"," Attestations provide a verifiable record of build conditions, including who built the package and under what circumstances.",[22,126,127,130],{},[109,128,129],{},"Trust verification:"," Consumers of your package can cryptographically verify its authenticity before installation.",[98,132,34],{"id":133},"pipeline-overview",[12,135,136],{},"Ensuring your code's integrity and authenticity is necessary. Imagine a pipeline that doesn't just compile your code but creates a cryptographically verifiable narrative of how, when, and by whom your package was created. Each stage acts as a guardian, checking and documenting the package's provenance.",[12,138,139],{},"Here are six stages of a GitLab pipeline that ensure your package is secure and trustworthy:",[19,141,142,145,148,151,154,157],{},[22,143,144],{},"Build: Creates a clean, standard package that can be easily shared and installed.",[22,146,147],{},"Signing: Adds a digital signature that proves the package hasn't been tampered with since it was created.",[22,149,150],{},"Verification: Double-checks that the signature is valid and the package meets all our security requirements.",[22,152,153],{},"Publishing: Uploads the verified package to GitLab's package registry, making it available for others to use.",[22,155,156],{},"Publishing Signatures: Makes signatures available for verification.",[22,158,159],{},"Consumer Verification: Simulates how end users can verify package authenticity.",[98,161,40],{"id":162},"complete-pipeline-implementation-setting-up-the-environment",[12,164,165],{},"Before we build our package, we need to set up a consistent and secure build environment. This configuration ensures every package is created with the same tools, settings, and security checks.",[167,168,48],"h3",{"id":169},"environment-configuration",[12,171,172],{},"Our pipeline requires specific tools and settings to work correctly.",[12,174,175],{},"Primary configurations:",[19,177,178,181,184,187],{},[22,179,180],{},"Python 3.10 for consistent builds",[22,182,183],{},"Cosign 2.2.3 for package signing",[22,185,186],{},"GitLab package registry integration",[22,188,189],{},"Hardcoded package version for reproducibility",[12,191,192,195,196,200],{},[109,193,194],{},"Note about versioning:"," We've chosen to use a hardcoded version (",[197,198,199],"code",{},"\"1.0.0\"",") in this example rather than deriving it from git tags or commits. This approach ensures complete reproducibility and makes the pipeline behavior more predictable. In a production environment, you might want to use semantic versioning based on git tags or another versioning strategy that fits your release process.",[12,202,203],{},"Tool requirements:",[19,205,206,216,219],{},[22,207,208,209,212,213],{},"Basic utilities: ",[197,210,211],{},"curl",", ",[197,214,215],{},"wget",[22,217,218],{},"Cosign for cryptographic signing",[22,220,221,222,212,225,212,228,212,231],{},"Python packaging tools: ",[197,223,224],{},"build",[197,226,227],{},"twine",[197,229,230],{},"setuptools",[197,232,233],{},"wheel",[167,235,54],{"id":236},"configuration-breakdown",[238,239,244],"pre",{"className":240,"code":241,"language":242,"meta":243,"style":243},"language-yaml shiki shiki-themes github-light","variables:\n  PYTHON_VERSION: '3.10'\n  PACKAGE_NAME: ${CI_PROJECT_NAME}\n  PACKAGE_VERSION: \"1.0.0\"\n  FULCIO_URL: 'https://fulcio.sigstore.dev'\n  REKOR_URL: 'https://rekor.sigstore.dev'\n  CERTIFICATE_IDENTITY: 'https://gitlab.com/${CI_PROJECT_PATH}//.gitlab-ci.yml@refs/heads/${CI_DEFAULT_BRANCH}'\n  CERTIFICATE_OIDC_ISSUER: 'https://gitlab.com'\n  PIP_CACHE_DIR: \"$CI_PROJECT_DIR/.pip-cache\"\n  COSIGN_YES: \"true\"\n  GENERIC_PACKAGE_BASE_URL: \"${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/${PACKAGE_NAME}/${PACKAGE_VERSION}\"\n\n","yaml","",[197,245,246,259,272,283,294,305,316,327,338,349,360],{"__ignoreMap":243},[247,248,251,255],"span",{"class":249,"line":250},"line",1,[247,252,254],{"class":253},"shJU0","variables",[247,256,258],{"class":257},"sgsFI",":\n",[247,260,262,265,268],{"class":249,"line":261},2,[247,263,264],{"class":253},"  PYTHON_VERSION",[247,266,267],{"class":257},": ",[247,269,271],{"class":270},"sYBdl","'3.10'\n",[247,273,275,278,280],{"class":249,"line":274},3,[247,276,277],{"class":253},"  PACKAGE_NAME",[247,279,267],{"class":257},[247,281,282],{"class":270},"${CI_PROJECT_NAME}\n",[247,284,286,289,291],{"class":249,"line":285},4,[247,287,288],{"class":253},"  PACKAGE_VERSION",[247,290,267],{"class":257},[247,292,293],{"class":270},"\"1.0.0\"\n",[247,295,297,300,302],{"class":249,"line":296},5,[247,298,299],{"class":253},"  FULCIO_URL",[247,301,267],{"class":257},[247,303,304],{"class":270},"'https://fulcio.sigstore.dev'\n",[247,306,308,311,313],{"class":249,"line":307},6,[247,309,310],{"class":253},"  REKOR_URL",[247,312,267],{"class":257},[247,314,315],{"class":270},"'https://rekor.sigstore.dev'\n",[247,317,319,322,324],{"class":249,"line":318},7,[247,320,321],{"class":253},"  CERTIFICATE_IDENTITY",[247,323,267],{"class":257},[247,325,326],{"class":270},"'https://gitlab.com/${CI_PROJECT_PATH}//.gitlab-ci.yml@refs/heads/${CI_DEFAULT_BRANCH}'\n",[247,328,330,333,335],{"class":249,"line":329},8,[247,331,332],{"class":253},"  CERTIFICATE_OIDC_ISSUER",[247,334,267],{"class":257},[247,336,337],{"class":270},"'https://gitlab.com'\n",[247,339,341,344,346],{"class":249,"line":340},9,[247,342,343],{"class":253},"  PIP_CACHE_DIR",[247,345,267],{"class":257},[247,347,348],{"class":270},"\"$CI_PROJECT_DIR/.pip-cache\"\n",[247,350,352,355,357],{"class":249,"line":351},10,[247,353,354],{"class":253},"  COSIGN_YES",[247,356,267],{"class":257},[247,358,359],{"class":270},"\"true\"\n",[247,361,363,366,368],{"class":249,"line":362},11,[247,364,365],{"class":253},"  GENERIC_PACKAGE_BASE_URL",[247,367,267],{"class":257},[247,369,370],{"class":270},"\"${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/${PACKAGE_NAME}/${PACKAGE_VERSION}\"\n",[12,372,373],{},"We use caching to speed up subsequent builds:",[238,375,377],{"className":240,"code":376,"language":242,"meta":243,"style":243},"cache:\n  paths:\n    - ${PIP_CACHE_DIR}\n\n",[197,378,379,386,393],{"__ignoreMap":243},[247,380,381,384],{"class":249,"line":250},[247,382,383],{"class":253},"cache",[247,385,258],{"class":257},[247,387,388,391],{"class":249,"line":261},[247,389,390],{"class":253},"  paths",[247,392,258],{"class":257},[247,394,395,398],{"class":249,"line":274},[247,396,397],{"class":257},"    - ",[247,399,400],{"class":270},"${PIP_CACHE_DIR}\n",[98,402,404],{"id":403},"building-crafting-the-package","Building: Crafting the package",[12,406,407],{},"Every software journey begins with creation. In our pipeline, the build stage is where raw code transforms into a distributable package, ready to travel across different Python environments.",[12,409,410],{},"The build process creates two standardized formats:",[19,412,413,416],{},[22,414,415],{},"a wheel package (.whl) for quick, efficient installation",[22,417,418],{},"a source distribution (.tar.gz) that carries the complete code",[12,420,421],{},"Here's the build stage implementation:",[238,423,425],{"className":240,"code":424,"language":242,"meta":243,"style":243},"build:\n  extends: .python-job\n  stage: build\n  script:\n    - git init\n    - git config --global init.defaultBranch main\n    - git config --global user.email \"ci@example.com\"\n    - git config --global user.name \"CI\"\n    - git add .\n    - git commit -m \"Initial commit\"\n    - export NORMALIZED_NAME=$(echo \"${CI_PROJECT_NAME}\" | tr '-' '_')\n    - sed -i \"s/name = \\\".*\\\"/name = \\\"${NORMALIZED_NAME}\\\"/\" pyproject.toml\n    - sed -i \"s|\\\"Homepage\\\" = \\\".*\\\"|\\\"Homepage\\\" = \\\"https://gitlab.com/${CI_PROJECT_PATH}\\\"|\" pyproject.toml\n    - python -m build\n  artifacts:\n    paths:\n      - dist/\n      - pyproject.toml\n\n",[197,426,427,433,443,453,460,467,474,481,488,495,502,509,517,525,533,541,549,558],{"__ignoreMap":243},[247,428,429,431],{"class":249,"line":250},[247,430,224],{"class":253},[247,432,258],{"class":257},[247,434,435,438,440],{"class":249,"line":261},[247,436,437],{"class":253},"  extends",[247,439,267],{"class":257},[247,441,442],{"class":270},".python-job\n",[247,444,445,448,450],{"class":249,"line":274},[247,446,447],{"class":253},"  stage",[247,449,267],{"class":257},[247,451,452],{"class":270},"build\n",[247,454,455,458],{"class":249,"line":285},[247,456,457],{"class":253},"  script",[247,459,258],{"class":257},[247,461,462,464],{"class":249,"line":296},[247,463,397],{"class":257},[247,465,466],{"class":270},"git init\n",[247,468,469,471],{"class":249,"line":307},[247,470,397],{"class":257},[247,472,473],{"class":270},"git config --global init.defaultBranch main\n",[247,475,476,478],{"class":249,"line":318},[247,477,397],{"class":257},[247,479,480],{"class":270},"git config --global user.email \"ci@example.com\"\n",[247,482,483,485],{"class":249,"line":329},[247,484,397],{"class":257},[247,486,487],{"class":270},"git config --global user.name \"CI\"\n",[247,489,490,492],{"class":249,"line":340},[247,491,397],{"class":257},[247,493,494],{"class":270},"git add .\n",[247,496,497,499],{"class":249,"line":351},[247,498,397],{"class":257},[247,500,501],{"class":270},"git commit -m \"Initial commit\"\n",[247,503,504,506],{"class":249,"line":362},[247,505,397],{"class":257},[247,507,508],{"class":270},"export NORMALIZED_NAME=$(echo \"${CI_PROJECT_NAME}\" | tr '-' '_')\n",[247,510,512,514],{"class":249,"line":511},12,[247,513,397],{"class":257},[247,515,516],{"class":270},"sed -i \"s/name = \\\".*\\\"/name = \\\"${NORMALIZED_NAME}\\\"/\" pyproject.toml\n",[247,518,520,522],{"class":249,"line":519},13,[247,521,397],{"class":257},[247,523,524],{"class":270},"sed -i \"s|\\\"Homepage\\\" = \\\".*\\\"|\\\"Homepage\\\" = \\\"https://gitlab.com/${CI_PROJECT_PATH}\\\"|\" pyproject.toml\n",[247,526,528,530],{"class":249,"line":527},14,[247,529,397],{"class":257},[247,531,532],{"class":270},"python -m build\n",[247,534,536,539],{"class":249,"line":535},15,[247,537,538],{"class":253},"  artifacts",[247,540,258],{"class":257},[247,542,544,547],{"class":249,"line":543},16,[247,545,546],{"class":253},"    paths",[247,548,258],{"class":257},[247,550,552,555],{"class":249,"line":551},17,[247,553,554],{"class":257},"      - ",[247,556,557],{"class":270},"dist/\n",[247,559,561,563],{"class":249,"line":560},18,[247,562,554],{"class":257},[247,564,565],{"class":270},"pyproject.toml\n",[12,567,568],{},"Let's break down what this build stage does:",[59,570,571,578,581,588,594],{},[22,572,573,574,577],{},"Initializes a Git repository (",[197,575,576],{},"git init",") and configures it with basic settings",[22,579,580],{},"Normalizes the package name by converting hyphens to underscores, which is required for Python packaging",[22,582,583,584,587],{},"Updates the package metadata in ",[197,585,586],{},"pyproject.toml"," to match our project settings",[22,589,590,591],{},"Builds both wheel and source distribution packages using ",[197,592,593],{},"python -m build",[22,595,596],{},"Preserves the built packages and configuration as artifacts for subsequent stages",[98,598,600],{"id":599},"signing-the-digital-notarization","Signing: The digital notarization",[12,602,603],{},"If attestation is the package's biography, signing is its cryptographic seal of authenticity. This is where we transform our package from a mere collection of files into a verified, tamper-evident artifact.",[12,605,606],{},"The signing stage uses Cosign to apply a digital signature as an unbreakable seal. This isn't just a stamp — it's a complex cryptographic handshake that proves the package's integrity and origin.",[238,608,610],{"className":240,"code":609,"language":242,"meta":243,"style":243},"sign:\n  extends: .python+cosign-job\n  stage: sign\n  id_tokens:\n    SIGSTORE_ID_TOKEN:\n      aud: sigstore\n  script:\n    - |\n      for file in dist/*.whl dist/*.tar.gz; do\n        if [ -f \"$file\" ]; then\n          filename=$(basename \"$file\")\n          cosign sign-blob --yes \\\n            --fulcio-url=${FULCIO_URL} \\\n            --rekor-url=${REKOR_URL} \\\n            --oidc-issuer $CI_SERVER_URL \\\n            --identity-token $SIGSTORE_ID_TOKEN \\\n            --output-signature \"dist/${filename}.sig\" \\\n            --output-certificate \"dist/${filename}.crt\" \\\n            \"$file\"\n        fi\n      done\n  artifacts:\n    paths:\n      - dist/\n\n",[197,611,612,619,628,637,644,651,661,667,675,680,685,690,695,700,705,710,715,720,725,731,737,743,750,757],{"__ignoreMap":243},[247,613,614,617],{"class":249,"line":250},[247,615,616],{"class":253},"sign",[247,618,258],{"class":257},[247,620,621,623,625],{"class":249,"line":261},[247,622,437],{"class":253},[247,624,267],{"class":257},[247,626,627],{"class":270},".python+cosign-job\n",[247,629,630,632,634],{"class":249,"line":274},[247,631,447],{"class":253},[247,633,267],{"class":257},[247,635,636],{"class":270},"sign\n",[247,638,639,642],{"class":249,"line":285},[247,640,641],{"class":253},"  id_tokens",[247,643,258],{"class":257},[247,645,646,649],{"class":249,"line":296},[247,647,648],{"class":253},"    SIGSTORE_ID_TOKEN",[247,650,258],{"class":257},[247,652,653,656,658],{"class":249,"line":307},[247,654,655],{"class":253},"      aud",[247,657,267],{"class":257},[247,659,660],{"class":270},"sigstore\n",[247,662,663,665],{"class":249,"line":318},[247,664,457],{"class":253},[247,666,258],{"class":257},[247,668,669,671],{"class":249,"line":329},[247,670,397],{"class":257},[247,672,674],{"class":673},"sD7c4","|\n",[247,676,677],{"class":249,"line":340},[247,678,679],{"class":270},"      for file in dist/*.whl dist/*.tar.gz; do\n",[247,681,682],{"class":249,"line":351},[247,683,684],{"class":270},"        if [ -f \"$file\" ]; then\n",[247,686,687],{"class":249,"line":362},[247,688,689],{"class":270},"          filename=$(basename \"$file\")\n",[247,691,692],{"class":249,"line":511},[247,693,694],{"class":270},"          cosign sign-blob --yes \\\n",[247,696,697],{"class":249,"line":519},[247,698,699],{"class":270},"            --fulcio-url=${FULCIO_URL} \\\n",[247,701,702],{"class":249,"line":527},[247,703,704],{"class":270},"            --rekor-url=${REKOR_URL} \\\n",[247,706,707],{"class":249,"line":535},[247,708,709],{"class":270},"            --oidc-issuer $CI_SERVER_URL \\\n",[247,711,712],{"class":249,"line":543},[247,713,714],{"class":270},"            --identity-token $SIGSTORE_ID_TOKEN \\\n",[247,716,717],{"class":249,"line":551},[247,718,719],{"class":270},"            --output-signature \"dist/${filename}.sig\" \\\n",[247,721,722],{"class":249,"line":560},[247,723,724],{"class":270},"            --output-certificate \"dist/${filename}.crt\" \\\n",[247,726,728],{"class":249,"line":727},19,[247,729,730],{"class":270},"            \"$file\"\n",[247,732,734],{"class":249,"line":733},20,[247,735,736],{"class":270},"        fi\n",[247,738,740],{"class":249,"line":739},21,[247,741,742],{"class":270},"      done\n",[247,744,746,748],{"class":249,"line":745},22,[247,747,538],{"class":253},[247,749,258],{"class":257},[247,751,753,755],{"class":249,"line":752},23,[247,754,546],{"class":253},[247,756,258],{"class":257},[247,758,760,762],{"class":249,"line":759},24,[247,761,554],{"class":257},[247,763,557],{"class":270},[12,765,766],{},"This signing stage performs several crucial operations:",[59,768,769,772,775,782,789],{},[22,770,771],{},"Obtains an OIDC token from GitLab for authentication with Sigstore services",[22,773,774],{},"Processes each built package (both wheel and source distribution)",[22,776,777,778,781],{},"Uses Cosign to create a cryptographic signature (",[197,779,780],{},".sig",") for each package",[22,783,784,785,788],{},"Generates a certificate (",[197,786,787],{},".crt",") that proves the signature's authenticity",[22,790,791],{},"Stores both signatures and certificates alongside the packages as artifacts",[98,793,795],{"id":794},"verification-the-security-checkpoint","Verification: The security checkpoint",[12,797,798],{},"Verification is our final quality control gate. It's not just a check — it's a security interrogation where every aspect of the package is scrutinized.",[238,800,802],{"className":240,"code":801,"language":242,"meta":243,"style":243},"verify:\n  extends: .python+cosign-job\n  stage: verify\n  script:\n    - |\n      failed=0\n      for file in dist/*.whl dist/*.tar.gz; do\n        if [ -f \"$file\" ]; then\n          filename=$(basename \"$file\")\n          if ! cosign verify-blob \\\n            --signature \"dist/${filename}.sig\" \\\n            --certificate \"dist/${filename}.crt\" \\\n            --certificate-identity \"${CERTIFICATE_IDENTITY}\" \\\n            --certificate-oidc-issuer \"${CERTIFICATE_OIDC_ISSUER}\" \\\n            \"$file\"; then\n            failed=1\n          fi\n        fi\n      done\n      if [ $failed -eq 1 ]; then\n        exit 1\n      fi\n\n",[197,803,804,811,819,828,834,840,845,849,853,857,862,867,872,877,882,887,892,897,901,905,910,915],{"__ignoreMap":243},[247,805,806,809],{"class":249,"line":250},[247,807,808],{"class":253},"verify",[247,810,258],{"class":257},[247,812,813,815,817],{"class":249,"line":261},[247,814,437],{"class":253},[247,816,267],{"class":257},[247,818,627],{"class":270},[247,820,821,823,825],{"class":249,"line":274},[247,822,447],{"class":253},[247,824,267],{"class":257},[247,826,827],{"class":270},"verify\n",[247,829,830,832],{"class":249,"line":285},[247,831,457],{"class":253},[247,833,258],{"class":257},[247,835,836,838],{"class":249,"line":296},[247,837,397],{"class":257},[247,839,674],{"class":673},[247,841,842],{"class":249,"line":307},[247,843,844],{"class":270},"      failed=0\n",[247,846,847],{"class":249,"line":318},[247,848,679],{"class":270},[247,850,851],{"class":249,"line":329},[247,852,684],{"class":270},[247,854,855],{"class":249,"line":340},[247,856,689],{"class":270},[247,858,859],{"class":249,"line":351},[247,860,861],{"class":270},"          if ! cosign verify-blob \\\n",[247,863,864],{"class":249,"line":362},[247,865,866],{"class":270},"            --signature \"dist/${filename}.sig\" \\\n",[247,868,869],{"class":249,"line":511},[247,870,871],{"class":270},"            --certificate \"dist/${filename}.crt\" \\\n",[247,873,874],{"class":249,"line":519},[247,875,876],{"class":270},"            --certificate-identity \"${CERTIFICATE_IDENTITY}\" \\\n",[247,878,879],{"class":249,"line":527},[247,880,881],{"class":270},"            --certificate-oidc-issuer \"${CERTIFICATE_OIDC_ISSUER}\" \\\n",[247,883,884],{"class":249,"line":535},[247,885,886],{"class":270},"            \"$file\"; then\n",[247,888,889],{"class":249,"line":543},[247,890,891],{"class":270},"            failed=1\n",[247,893,894],{"class":249,"line":551},[247,895,896],{"class":270},"          fi\n",[247,898,899],{"class":249,"line":560},[247,900,736],{"class":270},[247,902,903],{"class":249,"line":727},[247,904,742],{"class":270},[247,906,907],{"class":249,"line":733},[247,908,909],{"class":270},"      if [ $failed -eq 1 ]; then\n",[247,911,912],{"class":249,"line":739},[247,913,914],{"class":270},"        exit 1\n",[247,916,917],{"class":249,"line":745},[247,918,919],{"class":270},"      fi\n",[12,921,922],{},"The verification stage implements several security checks:",[59,924,925,932,935,938,941],{},[22,926,927,928,931],{},"Examines each package file in the ",[197,929,930],{},"dist"," directory",[22,933,934],{},"Uses Cosign to verify the signature matches the package content",[22,936,937],{},"Confirms the certificate's identity matches our expected GitLab pipeline identity",[22,939,940],{},"Validates our trusted OIDC provider issued the certificate",[22,942,943],{},"Fails the entire pipeline if any verification check fails, ensuring only verified packages proceed",[98,945,947],{"id":946},"publishing-the-controlled-release","Publishing: The controlled release",[12,949,950],{},"Publishing is where we make our verified packages available through GitLab's package registry. It's a carefully choreographed release that ensures only verified, authenticated packages reach their destination.",[238,952,954],{"className":240,"code":953,"language":242,"meta":243,"style":243},"publish:\n  extends: .python-job\n  stage: publish\n  script:\n    - |\n      cat \u003C\u003C EOF > ~/.pypirc\n      [distutils]\n      index-servers = gitlab\n      [gitlab]\n      repository = ${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/pypi\n      username = gitlab-ci-token\n      password = ${CI_JOB_TOKEN}\n      EOF\n      TWINE_PASSWORD=${CI_JOB_TOKEN} TWINE_USERNAME=gitlab-ci-token \\\n        twine upload --repository-url ${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/pypi \\\n        dist/*.whl dist/*.tar.gz\n\n",[197,955,956,963,971,980,986,992,997,1002,1007,1012,1017,1022,1027,1032,1037,1042],{"__ignoreMap":243},[247,957,958,961],{"class":249,"line":250},[247,959,960],{"class":253},"publish",[247,962,258],{"class":257},[247,964,965,967,969],{"class":249,"line":261},[247,966,437],{"class":253},[247,968,267],{"class":257},[247,970,442],{"class":270},[247,972,973,975,977],{"class":249,"line":274},[247,974,447],{"class":253},[247,976,267],{"class":257},[247,978,979],{"class":270},"publish\n",[247,981,982,984],{"class":249,"line":285},[247,983,457],{"class":253},[247,985,258],{"class":257},[247,987,988,990],{"class":249,"line":296},[247,989,397],{"class":257},[247,991,674],{"class":673},[247,993,994],{"class":249,"line":307},[247,995,996],{"class":270},"      cat \u003C\u003C EOF > ~/.pypirc\n",[247,998,999],{"class":249,"line":318},[247,1000,1001],{"class":270},"      [distutils]\n",[247,1003,1004],{"class":249,"line":329},[247,1005,1006],{"class":270},"      index-servers = gitlab\n",[247,1008,1009],{"class":249,"line":340},[247,1010,1011],{"class":270},"      [gitlab]\n",[247,1013,1014],{"class":249,"line":351},[247,1015,1016],{"class":270},"      repository = ${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/pypi\n",[247,1018,1019],{"class":249,"line":362},[247,1020,1021],{"class":270},"      username = gitlab-ci-token\n",[247,1023,1024],{"class":249,"line":511},[247,1025,1026],{"class":270},"      password = ${CI_JOB_TOKEN}\n",[247,1028,1029],{"class":249,"line":519},[247,1030,1031],{"class":270},"      EOF\n",[247,1033,1034],{"class":249,"line":527},[247,1035,1036],{"class":270},"      TWINE_PASSWORD=${CI_JOB_TOKEN} TWINE_USERNAME=gitlab-ci-token \\\n",[247,1038,1039],{"class":249,"line":535},[247,1040,1041],{"class":270},"        twine upload --repository-url ${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/pypi \\\n",[247,1043,1044],{"class":249,"line":543},[247,1045,1046],{"class":270},"        dist/*.whl dist/*.tar.gz\n",[12,1048,1049],{},"The publishing stage handles several important tasks:",[59,1051,1052,1059,1062,1065],{},[22,1053,1054,1055,1058],{},"Creates a ",[197,1056,1057],{},".pypirc"," configuration file with GitLab package registry credentials",[22,1060,1061],{},"Uses the GitLab CI job token for secure authentication",[22,1063,1064],{},"Uploads both wheel and source distribution packages to the GitLab PyPI registry",[22,1066,1067],{},"Makes the packages available for installation via pip",[98,1069,1071],{"id":1070},"publishing-signatures-making-verification-possible","Publishing signatures: Making verification possible",[12,1073,1074],{},"After publishing the packages, we must make their signatures and certificates available for verification. We store these in GitLab's generic package registry, making them easily accessible to users who want to verify package authenticity.",[238,1076,1078],{"className":240,"code":1077,"language":242,"meta":243,"style":243},"publish_signatures:\n  extends: .python+cosign-job\n  stage: publish_signatures\n  script:\n    - |\n      for file in dist/*.whl dist/*.tar.gz; do\n        if [ -f \"$file\" ]; then\n          filename=$(basename \"$file\")\n          curl --header \"JOB-TOKEN: ${CI_JOB_TOKEN}\" \\\n               --fail \\\n               --upload-file \"dist/${filename}.sig\" \\\n               \"${GENERIC_PACKAGE_BASE_URL}/${filename}.sig\"\n\n          curl --header \"JOB-TOKEN: ${CI_JOB_TOKEN}\" \\\n               --fail \\\n               --upload-file \"dist/${filename}.crt\" \\\n               \"${GENERIC_PACKAGE_BASE_URL}/${filename}.crt\"\n        fi\n      done\n\n",[197,1079,1080,1087,1095,1104,1110,1116,1120,1124,1128,1133,1138,1143,1148,1154,1158,1162,1167,1172,1176],{"__ignoreMap":243},[247,1081,1082,1085],{"class":249,"line":250},[247,1083,1084],{"class":253},"publish_signatures",[247,1086,258],{"class":257},[247,1088,1089,1091,1093],{"class":249,"line":261},[247,1090,437],{"class":253},[247,1092,267],{"class":257},[247,1094,627],{"class":270},[247,1096,1097,1099,1101],{"class":249,"line":274},[247,1098,447],{"class":253},[247,1100,267],{"class":257},[247,1102,1103],{"class":270},"publish_signatures\n",[247,1105,1106,1108],{"class":249,"line":285},[247,1107,457],{"class":253},[247,1109,258],{"class":257},[247,1111,1112,1114],{"class":249,"line":296},[247,1113,397],{"class":257},[247,1115,674],{"class":673},[247,1117,1118],{"class":249,"line":307},[247,1119,679],{"class":270},[247,1121,1122],{"class":249,"line":318},[247,1123,684],{"class":270},[247,1125,1126],{"class":249,"line":329},[247,1127,689],{"class":270},[247,1129,1130],{"class":249,"line":340},[247,1131,1132],{"class":270},"          curl --header \"JOB-TOKEN: ${CI_JOB_TOKEN}\" \\\n",[247,1134,1135],{"class":249,"line":351},[247,1136,1137],{"class":270},"               --fail \\\n",[247,1139,1140],{"class":249,"line":362},[247,1141,1142],{"class":270},"               --upload-file \"dist/${filename}.sig\" \\\n",[247,1144,1145],{"class":249,"line":511},[247,1146,1147],{"class":270},"               \"${GENERIC_PACKAGE_BASE_URL}/${filename}.sig\"\n",[247,1149,1150],{"class":249,"line":519},[247,1151,1153],{"emptyLinePlaceholder":1152},true,"\n",[247,1155,1156],{"class":249,"line":527},[247,1157,1132],{"class":270},[247,1159,1160],{"class":249,"line":535},[247,1161,1137],{"class":270},[247,1163,1164],{"class":249,"line":543},[247,1165,1166],{"class":270},"               --upload-file \"dist/${filename}.crt\" \\\n",[247,1168,1169],{"class":249,"line":551},[247,1170,1171],{"class":270},"               \"${GENERIC_PACKAGE_BASE_URL}/${filename}.crt\"\n",[247,1173,1174],{"class":249,"line":560},[247,1175,736],{"class":270},[247,1177,1178],{"class":249,"line":727},[247,1179,742],{"class":270},[12,1181,1182],{},"The signature publishing stage performs these key operations:",[59,1184,1185,1188,1194,1200,1203],{},[22,1186,1187],{},"Processes each built package to find its corresponding signature files",[22,1189,1190,1191,1193],{},"Uses the GitLab API to upload the signature (",[197,1192,780],{},") file to the generic package registry",[22,1195,1196,1197,1199],{},"Uploads the corresponding certificate (",[197,1198,787],{},") file",[22,1201,1202],{},"Makes these verification artifacts available for downstream package consumers",[22,1204,1205],{},"Uses the same version and package name to maintain the connection between packages and signatures",[98,1207,1209],{"id":1208},"consumer-verification-testing-the-user-experience","Consumer verification: Testing the user experience",[12,1211,1212],{},"The final stage simulates how end users will verify your package's authenticity. This stage acts as a final check and a practical example of the verification process.",[238,1214,1216],{"className":240,"code":1215,"language":242,"meta":243,"style":243},"consumer_verification:\n  extends: .python+cosign-job\n  stage: consumer_verification\n  script:\n    - |\n      git init\n      git config --global init.defaultBranch main\n      mkdir -p pkg signatures\n\n      pip download --index-url \"https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.com/api/v4/projects/${CI_PROJECT_ID}/packages/pypi/simple\" \\\n          \"${NORMALIZED_NAME}==${PACKAGE_VERSION}\" --no-deps -d ./pkg\n\n      pip download --no-binary :all: \\\n          --index-url \"https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.com/api/v4/projects/${CI_PROJECT_ID}/packages/pypi/simple\" \\\n          \"${NORMALIZED_NAME}==${PACKAGE_VERSION}\" --no-deps -d ./pkg\n\n      failed=0\n      for file in pkg/*.whl pkg/*.tar.gz; do\n        if [ -f \"$file\" ]; then\n          filename=$(basename \"$file\")\n          sig_url=\"${GENERIC_PACKAGE_BASE_URL}/${filename}.sig\"\n          cert_url=\"${GENERIC_PACKAGE_BASE_URL}/${filename}.crt\"\n\n          curl --fail --silent --show-error \\\n               --header \"JOB-TOKEN: ${CI_JOB_TOKEN}\" \\\n               --output \"signatures/${filename}.sig\" \\\n               \"$sig_url\"\n\n          curl --fail --silent --show-error \\\n               --header \"JOB-TOKEN: ${CI_JOB_TOKEN}\" \\\n               --output \"signatures/${filename}.crt\" \\\n               \"$cert_url\"\n\n          if ! cosign verify-blob \\\n            --signature \"signatures/${filename}.sig\" \\\n            --certificate \"signatures/${filename}.crt\" \\\n            --certificate-identity \"${CERTIFICATE_IDENTITY}\" \\\n            --certificate-oidc-issuer \"${CERTIFICATE_OIDC_ISSUER}\" \\\n            \"$file\"; then\n            failed=1\n          fi\n        fi\n      done\n\n      if [ $failed -eq 1 ]; then\n        exit 1\n      fi\n\n",[197,1217,1218,1225,1233,1242,1248,1254,1259,1264,1269,1273,1278,1283,1287,1292,1297,1301,1305,1309,1314,1318,1322,1327,1332,1336,1341,1347,1353,1359,1364,1369,1374,1380,1386,1391,1396,1402,1408,1413,1418,1423,1428,1433,1438,1443,1448,1453,1458],{"__ignoreMap":243},[247,1219,1220,1223],{"class":249,"line":250},[247,1221,1222],{"class":253},"consumer_verification",[247,1224,258],{"class":257},[247,1226,1227,1229,1231],{"class":249,"line":261},[247,1228,437],{"class":253},[247,1230,267],{"class":257},[247,1232,627],{"class":270},[247,1234,1235,1237,1239],{"class":249,"line":274},[247,1236,447],{"class":253},[247,1238,267],{"class":257},[247,1240,1241],{"class":270},"consumer_verification\n",[247,1243,1244,1246],{"class":249,"line":285},[247,1245,457],{"class":253},[247,1247,258],{"class":257},[247,1249,1250,1252],{"class":249,"line":296},[247,1251,397],{"class":257},[247,1253,674],{"class":673},[247,1255,1256],{"class":249,"line":307},[247,1257,1258],{"class":270},"      git init\n",[247,1260,1261],{"class":249,"line":318},[247,1262,1263],{"class":270},"      git config --global init.defaultBranch main\n",[247,1265,1266],{"class":249,"line":329},[247,1267,1268],{"class":270},"      mkdir -p pkg signatures\n",[247,1270,1271],{"class":249,"line":340},[247,1272,1153],{"emptyLinePlaceholder":1152},[247,1274,1275],{"class":249,"line":351},[247,1276,1277],{"class":270},"      pip download --index-url \"https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.com/api/v4/projects/${CI_PROJECT_ID}/packages/pypi/simple\" \\\n",[247,1279,1280],{"class":249,"line":362},[247,1281,1282],{"class":270},"          \"${NORMALIZED_NAME}==${PACKAGE_VERSION}\" --no-deps -d ./pkg\n",[247,1284,1285],{"class":249,"line":511},[247,1286,1153],{"emptyLinePlaceholder":1152},[247,1288,1289],{"class":249,"line":519},[247,1290,1291],{"class":270},"      pip download --no-binary :all: \\\n",[247,1293,1294],{"class":249,"line":527},[247,1295,1296],{"class":270},"          --index-url \"https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.com/api/v4/projects/${CI_PROJECT_ID}/packages/pypi/simple\" \\\n",[247,1298,1299],{"class":249,"line":535},[247,1300,1282],{"class":270},[247,1302,1303],{"class":249,"line":543},[247,1304,1153],{"emptyLinePlaceholder":1152},[247,1306,1307],{"class":249,"line":551},[247,1308,844],{"class":270},[247,1310,1311],{"class":249,"line":560},[247,1312,1313],{"class":270},"      for file in pkg/*.whl pkg/*.tar.gz; do\n",[247,1315,1316],{"class":249,"line":727},[247,1317,684],{"class":270},[247,1319,1320],{"class":249,"line":733},[247,1321,689],{"class":270},[247,1323,1324],{"class":249,"line":739},[247,1325,1326],{"class":270},"          sig_url=\"${GENERIC_PACKAGE_BASE_URL}/${filename}.sig\"\n",[247,1328,1329],{"class":249,"line":745},[247,1330,1331],{"class":270},"          cert_url=\"${GENERIC_PACKAGE_BASE_URL}/${filename}.crt\"\n",[247,1333,1334],{"class":249,"line":752},[247,1335,1153],{"emptyLinePlaceholder":1152},[247,1337,1338],{"class":249,"line":759},[247,1339,1340],{"class":270},"          curl --fail --silent --show-error \\\n",[247,1342,1344],{"class":249,"line":1343},25,[247,1345,1346],{"class":270},"               --header \"JOB-TOKEN: ${CI_JOB_TOKEN}\" \\\n",[247,1348,1350],{"class":249,"line":1349},26,[247,1351,1352],{"class":270},"               --output \"signatures/${filename}.sig\" \\\n",[247,1354,1356],{"class":249,"line":1355},27,[247,1357,1358],{"class":270},"               \"$sig_url\"\n",[247,1360,1362],{"class":249,"line":1361},28,[247,1363,1153],{"emptyLinePlaceholder":1152},[247,1365,1367],{"class":249,"line":1366},29,[247,1368,1340],{"class":270},[247,1370,1372],{"class":249,"line":1371},30,[247,1373,1346],{"class":270},[247,1375,1377],{"class":249,"line":1376},31,[247,1378,1379],{"class":270},"               --output \"signatures/${filename}.crt\" \\\n",[247,1381,1383],{"class":249,"line":1382},32,[247,1384,1385],{"class":270},"               \"$cert_url\"\n",[247,1387,1389],{"class":249,"line":1388},33,[247,1390,1153],{"emptyLinePlaceholder":1152},[247,1392,1394],{"class":249,"line":1393},34,[247,1395,861],{"class":270},[247,1397,1399],{"class":249,"line":1398},35,[247,1400,1401],{"class":270},"            --signature \"signatures/${filename}.sig\" \\\n",[247,1403,1405],{"class":249,"line":1404},36,[247,1406,1407],{"class":270},"            --certificate \"signatures/${filename}.crt\" \\\n",[247,1409,1411],{"class":249,"line":1410},37,[247,1412,876],{"class":270},[247,1414,1416],{"class":249,"line":1415},38,[247,1417,881],{"class":270},[247,1419,1421],{"class":249,"line":1420},39,[247,1422,886],{"class":270},[247,1424,1426],{"class":249,"line":1425},40,[247,1427,891],{"class":270},[247,1429,1431],{"class":249,"line":1430},41,[247,1432,896],{"class":270},[247,1434,1436],{"class":249,"line":1435},42,[247,1437,736],{"class":270},[247,1439,1441],{"class":249,"line":1440},43,[247,1442,742],{"class":270},[247,1444,1446],{"class":249,"line":1445},44,[247,1447,1153],{"emptyLinePlaceholder":1152},[247,1449,1451],{"class":249,"line":1450},45,[247,1452,909],{"class":270},[247,1454,1456],{"class":249,"line":1455},46,[247,1457,914],{"class":270},[247,1459,1461],{"class":249,"line":1460},47,[247,1462,919],{"class":270},[12,1464,1465],{},"This consumer verification stage simulates the end-user experience by:",[59,1467,1468,1471,1474,1477,1480,1483],{},[22,1469,1470],{},"Creating a clean environment to test package installation",[22,1472,1473],{},"Downloading the published packages from the GitLab PyPI registry",[22,1475,1476],{},"Retrieving the corresponding signatures and certificates from the generic package registry",[22,1478,1479],{},"Performing the same verification steps that end users would perform",[22,1481,1482],{},"Ensuring the entire process works from a consumer's perspective",[22,1484,1485],{},"Failing the pipeline if any verification step fails, providing an early warning of any issues",[98,1487,1489],{"id":1488},"summary","Summary",[12,1491,1492],{},"This comprehensive pipeline provides a secure and reliable way to build, sign, and publish Python packages to GitLab's package registry. By following these practices and implementing the suggested security measures, you can ensure your packages are appropriately verified and safely distributed to your users.",[12,1494,1495],{},"The pipeline combines modern security practices with efficient automation to create a robust software supply chain. Using Sigstore's Cosign for signing and attestation, along with GitLab's built-in security features, you can provide users with trustworthy cryptographically verified packages.",[1497,1498,1499],"blockquote",{},[1500,1501,1503,1504,1509],"h4",{"id":1502},"get-started-on-your-security-journey-today-with-a-free-trial-of-gitlab-ultimate","Get started on your security journey today with a ",[25,1505,1508],{"href":1506,"rel":1507},"https://gitlab.com/-/trials/new?glm_content=default-saas-trial&glm_source=about.gitlab.com",[],"free trial of GitLab Ultimate",".",[98,1511,1513],{"id":1512},"learn-more","Learn more",[19,1515,1516,1523,1530],{},[22,1517,1518],{},[25,1519,1522],{"href":1520,"rel":1521},"https://docs.gitlab.com/ci/yaml/signing_examples/",[],"Documentation: Use Sigstore for keyless signing and verification",[22,1524,1525],{},[25,1526,1529],{"href":1527,"rel":1528},"https://about.gitlab.com/blog/keyless-signing-with-cosign/",[],"Streamline security with keyless signing and verification in GitLab",[22,1531,1532],{},[25,1533,1536],{"href":1534,"rel":1535},"https://about.gitlab.com/blog/annotate-container-images-with-build-provenance-using-cosign-in-gitlab-ci-cd/",[],"Annotate container images with build provenance using Cosign in GitLab CI/CD",[1538,1539,1540],"style",{},"html pre.shiki code .shJU0, html code.shiki .shJU0{--shiki-default:#22863A}html pre.shiki code .sgsFI, html code.shiki .sgsFI{--shiki-default:#24292E}html pre.shiki code .sYBdl, html code.shiki .sYBdl{--shiki-default:#032F62}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .sD7c4, html code.shiki .sD7c4{--shiki-default:#D73A49}",{"title":243,"searchDepth":261,"depth":261,"links":1542},[1543,1544,1545,1549,1550,1551,1552,1553,1554,1555,1556],{"id":100,"depth":261,"text":28},{"id":133,"depth":261,"text":34},{"id":162,"depth":261,"text":40,"children":1546},[1547,1548],{"id":169,"depth":274,"text":48},{"id":236,"depth":274,"text":54},{"id":403,"depth":261,"text":404},{"id":599,"depth":261,"text":600},{"id":794,"depth":261,"text":795},{"id":946,"depth":261,"text":947},{"id":1070,"depth":261,"text":1071},{"id":1208,"depth":261,"text":1209},{"id":1488,"depth":261,"text":1489},{"id":1512,"depth":261,"text":1513},"security","2025-01-21","Learn how to implement a secure CI/CD pipeline across five stages with the GitLab DevSecOps platform.","md",null,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749662080/Blog/Hero%20Images/AdobeStock_1097303277.jpg",{},"/en-us/blog/secure-and-publish-python-packages-a-guide-to-ci-integration",{"title":5,"description":1559,"ogTitle":5,"ogDescription":1559,"noIndex":1566,"ogImage":1562,"ogUrl":1567,"ogSiteName":1568,"ogType":1569,"canonicalUrls":1567},false,"https://about.gitlab.com/blog/secure-and-publish-python-packages-a-guide-to-ci-integration","https://about.gitlab.com","article","secure-and-publish-python-packages-a-guide-to-ci-integration","en-us/blog/secure-and-publish-python-packages-a-guide-to-ci-integration",[1557,1573,1574,1575,1576,1577,1578,1579,1580],"integrations","partners","features","CI","CI/CD","DevSecOps platform","tutorial","solutions architecture","BlogPost","a6Mp-OVyeBhsAv34l4DbZiAejeVWg0oGjYUOF0MJ8M4",{"logo":1584,"freeTrial":1589,"sales":1594,"login":1599,"items":1604,"search":1926,"minimal":1957,"duo":1976,"switchNav":1985,"pricingDeployment":1996},{"config":1585},{"href":1586,"dataGaName":1587,"dataGaLocation":1588},"/","gitlab logo","header",{"text":1590,"config":1591},"Get free trial",{"href":1592,"dataGaName":1593,"dataGaLocation":1588},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":1595,"config":1596},"Request a demo",{"href":1597,"dataGaName":1598,"dataGaLocation":1588},"/sales/?contact-topic=request-demo","sales",{"text":1600,"config":1601},"Sign in",{"href":1602,"dataGaName":1603,"dataGaLocation":1588},"https://gitlab.com/users/sign_in/","sign in",[1605,1633,1731,1736,1848,1904],{"text":1606,"config":1607,"menu":1609},"Platform",{"dataNavLevelOne":1608},"platform",{"type":1610,"columns":1611},"cards",[1612,1618,1626],{"title":1606,"description":1613,"link":1614},"The intelligent orchestration platform for DevSecOps",{"text":1615,"config":1616},"Explore our Platform",{"href":1617,"dataGaName":1608,"dataGaLocation":1588},"/platform/",{"title":1619,"description":1620,"link":1621},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":1622,"config":1623},"Meet GitLab Duo",{"href":1624,"dataGaName":1625,"dataGaLocation":1588},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":1627,"description":1628,"link":1629},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":1513,"config":1630},{"href":1631,"dataGaName":1632,"dataGaLocation":1588},"/why-gitlab/","why gitlab",{"text":1634,"left":1152,"config":1635,"menu":1637},"Product",{"dataNavLevelOne":1636},"solutions",{"type":1638,"link":1639,"columns":1643,"feature":1711},"lists",{"text":1640,"config":1641},"View all Solutions",{"href":1642,"dataGaName":1636,"dataGaLocation":1588},"/solutions/",[1644,1667,1690],{"title":1645,"description":1646,"link":1647,"items":1652},"Automation","CI/CD and automation to accelerate deployment",{"config":1648},{"icon":1649,"href":1650,"dataGaName":1651,"dataGaLocation":1588},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[1653,1656,1659,1663],{"text":1577,"config":1654},{"href":1655,"dataGaLocation":1588,"dataGaName":1577},"/solutions/continuous-integration/",{"text":1619,"config":1657},{"href":1624,"dataGaLocation":1588,"dataGaName":1658},"gitlab duo agent platform - product menu",{"text":1660,"config":1661},"Source Code Management",{"href":1662,"dataGaLocation":1588,"dataGaName":1660},"/solutions/source-code-management/",{"text":1664,"config":1665},"Automated Software Delivery",{"href":1650,"dataGaLocation":1588,"dataGaName":1666},"Automated software delivery",{"title":1668,"description":1669,"link":1670,"items":1675},"Security","Deliver code faster without compromising security",{"config":1671},{"href":1672,"dataGaName":1673,"dataGaLocation":1588,"icon":1674},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[1676,1680,1685],{"text":1677,"config":1678},"Application Security Testing",{"href":1672,"dataGaName":1679,"dataGaLocation":1588},"Application security testing",{"text":1681,"config":1682},"Software Supply Chain Security",{"href":1683,"dataGaLocation":1588,"dataGaName":1684},"/solutions/supply-chain/","Software supply chain security",{"text":1686,"config":1687},"Software Compliance",{"href":1688,"dataGaName":1689,"dataGaLocation":1588},"/solutions/software-compliance/","software compliance",{"title":1691,"link":1692,"items":1697},"Measurement",{"config":1693},{"icon":1694,"href":1695,"dataGaName":1696,"dataGaLocation":1588},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[1698,1702,1706],{"text":1699,"config":1700},"Visibility & Measurement",{"href":1695,"dataGaLocation":1588,"dataGaName":1701},"Visibility and Measurement",{"text":1703,"config":1704},"Value Stream Management",{"href":1705,"dataGaLocation":1588,"dataGaName":1703},"/solutions/value-stream-management/",{"text":1707,"config":1708},"Analytics & Insights",{"href":1709,"dataGaLocation":1588,"dataGaName":1710},"/solutions/analytics-and-insights/","Analytics and insights",{"title":1712,"type":1638,"items":1713},"GitLab for",[1714,1719,1725],{"text":1715,"config":1716},"Enterprise",{"icon":66,"href":1717,"dataGaLocation":1588,"dataGaName":1718},"/enterprise/","enterprise",{"text":1720,"config":1721},"Small Business",{"icon":1722,"href":1723,"dataGaLocation":1588,"dataGaName":1724},"Work","/small-business/","small business",{"text":1726,"config":1727},"Public Sector",{"icon":1728,"href":1729,"dataGaLocation":1588,"dataGaName":1730},"Organization","/solutions/public-sector/","public sector",{"text":1732,"config":1733},"Pricing",{"href":1734,"dataGaName":1735,"dataGaLocation":1588,"dataNavLevelOne":1735},"/pricing/","pricing",{"text":1737,"config":1738,"menu":1740},"Resources",{"dataNavLevelOne":1739},"resources",{"type":1638,"link":1741,"columns":1745,"feature":1837},{"text":1742,"config":1743},"View all resources",{"href":1744,"dataGaName":1739,"dataGaLocation":1588},"/resources/",[1746,1778,1805],{"title":1747,"items":1748},"Getting started",[1749,1754,1759,1764,1769,1774],{"text":1750,"config":1751},"Install",{"href":1752,"dataGaName":1753,"dataGaLocation":1588},"/install/","install",{"text":1755,"config":1756},"Quick start guides",{"href":1757,"dataGaName":1758,"dataGaLocation":1588},"/get-started/","quick setup checklists",{"text":1760,"config":1761},"Learn",{"href":1762,"dataGaLocation":1588,"dataGaName":1763},"https://university.gitlab.com/","learn",{"text":1765,"config":1766},"Product documentation",{"href":1767,"dataGaName":1768,"dataGaLocation":1588},"https://docs.gitlab.com/","product documentation",{"text":1770,"config":1771},"Best practice videos",{"href":1772,"dataGaName":1773,"dataGaLocation":1588},"/getting-started-videos/","best practice videos",{"text":1775,"config":1776},"Integrations",{"href":1777,"dataGaName":1573,"dataGaLocation":1588},"/integrations/",{"title":1779,"items":1780},"Discover",[1781,1786,1791,1796,1800],{"text":1782,"config":1783},"Customer success stories",{"href":1784,"dataGaName":1785,"dataGaLocation":1588},"/customers/","customer success stories",{"text":1787,"config":1788},"Blog",{"href":1789,"dataGaName":1790,"dataGaLocation":1588},"/blog/","blog",{"text":1792,"config":1793},"Demo Hub",{"href":1794,"dataGaName":1795,"dataGaLocation":1588},"/demo-hub/","demo hub",{"text":1797,"config":1798},"The Source",{"href":1799,"dataGaName":1790,"dataGaLocation":1588},"/the-source/",{"text":1801,"config":1802},"Remote",{"href":1803,"dataGaName":1804,"dataGaLocation":1588},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":1806,"items":1807},"Connect",[1808,1813,1818,1823,1828,1833],{"text":1809,"config":1810},"GitLab Services",{"href":1811,"dataGaName":1812,"dataGaLocation":1588},"/services/","services",{"text":1814,"config":1815},"Contribute",{"href":1816,"dataGaName":1817,"dataGaLocation":1588},"https://contributors.gitlab.com","contribute",{"text":1819,"config":1820},"Community",{"href":1821,"dataGaName":1822,"dataGaLocation":1588},"/community/","community",{"text":1824,"config":1825},"Forum",{"href":1826,"dataGaName":1827,"dataGaLocation":1588},"https://forum.gitlab.com/","forum",{"text":1829,"config":1830},"Events",{"href":1831,"dataGaName":1832,"dataGaLocation":1588},"/events/","events",{"text":1834,"config":1835},"Partners",{"href":1836,"dataGaName":1574,"dataGaLocation":1588},"/partners/",{"config":1838,"title":1841,"text":1842,"link":1843},{"background":1839,"textColor":1840},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":1844,"config":1845},"Read the latest",{"href":1846,"dataGaName":1847,"dataGaLocation":1588},"/whats-new/","whats new",{"text":1849,"config":1850,"menu":1852},"Company",{"dataNavLevelOne":1851},"company",{"type":1638,"columns":1853},[1854],{"items":1855},[1856,1861,1867,1869,1874,1879,1884,1889,1894,1899],{"text":1857,"config":1858},"About",{"href":1859,"dataGaName":1860,"dataGaLocation":1588},"/company/","about",{"text":1862,"config":1863,"footerGa":1866},"Jobs",{"href":1864,"dataGaName":1865,"dataGaLocation":1588},"/jobs/","jobs",{"dataGaName":1865},{"text":1829,"config":1868},{"href":1831,"dataGaName":1832,"dataGaLocation":1588},{"text":1870,"config":1871},"Leadership",{"href":1872,"dataGaName":1873,"dataGaLocation":1588},"/company/team/e-group/","leadership",{"text":1875,"config":1876},"Handbook",{"href":1877,"dataGaName":1878,"dataGaLocation":1588},"https://handbook.gitlab.com/","handbook",{"text":1880,"config":1881},"Investor relations",{"href":1882,"dataGaName":1883,"dataGaLocation":1588},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":1885,"config":1886},"Trust Center",{"href":1887,"dataGaName":1888,"dataGaLocation":1588},"/security/","trust center",{"text":1890,"config":1891},"AI Transparency Center",{"href":1892,"dataGaName":1893,"dataGaLocation":1588},"/ai-transparency-center/","ai transparency center",{"text":1895,"config":1896},"Newsletter",{"href":1897,"dataGaName":1898,"dataGaLocation":1588},"/company/contact/#contact-forms","newsletter",{"text":1900,"config":1901},"Press",{"href":1902,"dataGaName":1903,"dataGaLocation":1588},"/press/","press",{"text":1905,"config":1906,"menu":1907},"Contact us",{"dataNavLevelOne":1851},{"type":1638,"columns":1908},[1909],{"items":1910},[1911,1916,1921],{"text":1912,"config":1913},"Talk to sales",{"href":1914,"dataGaName":1915,"dataGaLocation":1588},"/sales/","talk to sales",{"text":1917,"config":1918},"Support portal",{"href":1919,"dataGaName":1920,"dataGaLocation":1588},"https://support.gitlab.com/hc/en-us","support portal",{"text":1922,"config":1923},"Customer portal",{"href":1924,"dataGaName":1925,"dataGaLocation":1588},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":1927,"login":1928,"suggestions":1935},"Close",{"text":1929,"link":1930},"To search repositories and projects, login to",{"text":1931,"config":1932},"gitlab.com",{"href":1602,"dataGaName":1933,"dataGaLocation":1934},"search login","search",{"text":1936,"default":1937},"Suggestions",[1938,1940,1944,1946,1950,1954],{"text":1619,"config":1939},{"href":1624,"dataGaName":1619,"dataGaLocation":1934},{"text":1941,"config":1942},"Code Suggestions (AI)",{"href":1943,"dataGaName":1941,"dataGaLocation":1934},"/solutions/code-suggestions/",{"text":1577,"config":1945},{"href":1655,"dataGaName":1577,"dataGaLocation":1934},{"text":1947,"config":1948},"GitLab on AWS",{"href":1949,"dataGaName":1947,"dataGaLocation":1934},"/partners/technology-partners/aws/",{"text":1951,"config":1952},"GitLab on Google Cloud",{"href":1953,"dataGaName":1951,"dataGaLocation":1934},"/partners/technology-partners/google-cloud-platform/",{"text":1955,"config":1956},"Why GitLab?",{"href":1631,"dataGaName":1955,"dataGaLocation":1934},{"freeTrial":1958,"mobileIcon":1963,"desktopIcon":1968,"secondaryButton":1971},{"text":1959,"config":1960},"Start free trial",{"href":1961,"dataGaName":1593,"dataGaLocation":1962},"https://gitlab.com/-/trials/new/","nav",{"altText":1964,"config":1965},"Gitlab Icon",{"src":1966,"dataGaName":1967,"dataGaLocation":1962},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":1964,"config":1969},{"src":1970,"dataGaName":1967,"dataGaLocation":1962},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":1972,"config":1973},"Get Started",{"href":1974,"dataGaName":1975,"dataGaLocation":1962},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":1977,"mobileIcon":1981,"desktopIcon":1983},{"text":1978,"config":1979},"Learn more about GitLab Duo",{"href":1624,"dataGaName":1980,"dataGaLocation":1962},"gitlab duo",{"altText":1964,"config":1982},{"src":1966,"dataGaName":1967,"dataGaLocation":1962},{"altText":1964,"config":1984},{"src":1970,"dataGaName":1967,"dataGaLocation":1962},{"button":1986,"mobileIcon":1991,"desktopIcon":1993},{"text":1987,"config":1988},"/switch",{"href":1989,"dataGaName":1990,"dataGaLocation":1962},"#contact","switch",{"altText":1964,"config":1992},{"src":1966,"dataGaName":1967,"dataGaLocation":1962},{"altText":1964,"config":1994},{"src":1995,"dataGaName":1967,"dataGaLocation":1962},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":1997,"mobileIcon":2002,"desktopIcon":2004},{"text":1998,"config":1999},"Back to pricing",{"href":1734,"dataGaName":2000,"dataGaLocation":1962,"icon":2001},"back to pricing","GoBack",{"altText":1964,"config":2003},{"src":1966,"dataGaName":1967,"dataGaLocation":1962},{"altText":1964,"config":2005},{"src":1970,"dataGaName":1967,"dataGaLocation":1962},{"title":2007,"titleMobile":2008,"button":2009,"config":2014},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":1513,"config":2010},{"href":2011,"dataGaName":2012,"dataGaLocation":2013},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":2015,"disabled":1566},"release",{"data":2017},{"text":2018,"source":2019,"edit":2025,"contribute":2030,"config":2035,"items":2040,"minimal":2249},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":2020,"config":2021},"View page source",{"href":2022,"dataGaName":2023,"dataGaLocation":2024},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":2026,"config":2027},"Edit this page",{"href":2028,"dataGaName":2029,"dataGaLocation":2024},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":2031,"config":2032},"Please contribute",{"href":2033,"dataGaName":2034,"dataGaLocation":2024},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":2036,"facebook":2037,"youtube":2038,"linkedin":2039},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[2041,2088,2141,2185,2217],{"title":1732,"links":2042,"subMenu":2057},[2043,2047,2052],{"text":2044,"config":2045},"View plans",{"href":1734,"dataGaName":2046,"dataGaLocation":2024},"view plans",{"text":2048,"config":2049},"Why Premium?",{"href":2050,"dataGaName":2051,"dataGaLocation":2024},"/pricing/premium/","why premium",{"text":2053,"config":2054},"Why Ultimate?",{"href":2055,"dataGaName":2056,"dataGaLocation":2024},"/pricing/ultimate/","why ultimate",[2058],{"title":2059,"links":2060},"Contact Us",[2061,2064,2066,2068,2073,2078,2083],{"text":2062,"config":2063},"Contact sales",{"href":1914,"dataGaName":1598,"dataGaLocation":2024},{"text":1917,"config":2065},{"href":1919,"dataGaName":1920,"dataGaLocation":2024},{"text":1922,"config":2067},{"href":1924,"dataGaName":1925,"dataGaLocation":2024},{"text":2069,"config":2070},"Status",{"href":2071,"dataGaName":2072,"dataGaLocation":2024},"https://status.gitlab.com/","status",{"text":2074,"config":2075},"Terms of use",{"href":2076,"dataGaName":2077,"dataGaLocation":2024},"/terms/","terms of use",{"text":2079,"config":2080},"Privacy statement",{"href":2081,"dataGaName":2082,"dataGaLocation":2024},"/privacy/","privacy statement",{"text":2084,"config":2085},"Cookie preferences",{"dataGaName":2086,"dataGaLocation":2024,"id":2087,"isOneTrustButton":1152},"cookie preferences","ot-sdk-btn",{"title":1634,"links":2089,"subMenu":2097},[2090,2093],{"text":1578,"config":2091},{"href":1617,"dataGaName":2092,"dataGaLocation":2024},"devsecops platform",{"text":2094,"config":2095},"AI-Assisted Development",{"href":1624,"dataGaName":2096,"dataGaLocation":2024},"ai-assisted development",[2098],{"title":2099,"links":2100},"Topics",[2101,2106,2111,2116,2121,2126,2131,2136],{"text":2102,"config":2103},"CICD",{"href":2104,"dataGaName":2105,"dataGaLocation":2024},"/topics/ci-cd/","cicd",{"text":2107,"config":2108},"GitOps",{"href":2109,"dataGaName":2110,"dataGaLocation":2024},"/topics/gitops/","gitops",{"text":2112,"config":2113},"DevOps",{"href":2114,"dataGaName":2115,"dataGaLocation":2024},"/topics/devops/","devops",{"text":2117,"config":2118},"Version Control",{"href":2119,"dataGaName":2120,"dataGaLocation":2024},"/topics/version-control/","version control",{"text":2122,"config":2123},"DevSecOps",{"href":2124,"dataGaName":2125,"dataGaLocation":2024},"/topics/devsecops/","devsecops",{"text":2127,"config":2128},"Cloud Native",{"href":2129,"dataGaName":2130,"dataGaLocation":2024},"/topics/cloud-native/","cloud native",{"text":2132,"config":2133},"AI for Coding",{"href":2134,"dataGaName":2135,"dataGaLocation":2024},"/topics/devops/ai-for-coding/","ai for coding",{"text":2137,"config":2138},"Agentic AI",{"href":2139,"dataGaName":2140,"dataGaLocation":2024},"/topics/agentic-ai/","agentic ai",{"title":2142,"links":2143},"Solutions",[2144,2146,2148,2153,2157,2160,2164,2167,2169,2172,2175,2180],{"text":1677,"config":2145},{"href":1672,"dataGaName":1677,"dataGaLocation":2024},{"text":1666,"config":2147},{"href":1650,"dataGaName":1651,"dataGaLocation":2024},{"text":2149,"config":2150},"Agile development",{"href":2151,"dataGaName":2152,"dataGaLocation":2024},"/solutions/agile-delivery/","agile delivery",{"text":2154,"config":2155},"SCM",{"href":1662,"dataGaName":2156,"dataGaLocation":2024},"source code management",{"text":2102,"config":2158},{"href":1655,"dataGaName":2159,"dataGaLocation":2024},"continuous integration & delivery",{"text":2161,"config":2162},"Value stream management",{"href":1705,"dataGaName":2163,"dataGaLocation":2024},"value stream management",{"text":2107,"config":2165},{"href":2166,"dataGaName":2110,"dataGaLocation":2024},"/solutions/gitops/",{"text":1715,"config":2168},{"href":1717,"dataGaName":1718,"dataGaLocation":2024},{"text":2170,"config":2171},"Small business",{"href":1723,"dataGaName":1724,"dataGaLocation":2024},{"text":2173,"config":2174},"Public sector",{"href":1729,"dataGaName":1730,"dataGaLocation":2024},{"text":2176,"config":2177},"Education",{"href":2178,"dataGaName":2179,"dataGaLocation":2024},"/solutions/education/","education",{"text":2181,"config":2182},"Financial services",{"href":2183,"dataGaName":2184,"dataGaLocation":2024},"/solutions/finance/","financial services",{"title":1737,"links":2186},[2187,2189,2191,2193,2196,2198,2201,2203,2205,2207,2209,2211,2213,2215],{"text":1750,"config":2188},{"href":1752,"dataGaName":1753,"dataGaLocation":2024},{"text":1755,"config":2190},{"href":1757,"dataGaName":1758,"dataGaLocation":2024},{"text":1760,"config":2192},{"href":1762,"dataGaName":1763,"dataGaLocation":2024},{"text":1765,"config":2194},{"href":1767,"dataGaName":2195,"dataGaLocation":2024},"docs",{"text":1787,"config":2197},{"href":1789,"dataGaName":1790,"dataGaLocation":2024},{"text":2199,"config":2200},"What's new",{"href":1846,"dataGaName":1847,"dataGaLocation":2024},{"text":1782,"config":2202},{"href":1784,"dataGaName":1785,"dataGaLocation":2024},{"text":1801,"config":2204},{"href":1803,"dataGaName":1804,"dataGaLocation":2024},{"text":1809,"config":2206},{"href":1811,"dataGaName":1812,"dataGaLocation":2024},{"text":1814,"config":2208},{"href":1816,"dataGaName":1817,"dataGaLocation":2024},{"text":1819,"config":2210},{"href":1821,"dataGaName":1822,"dataGaLocation":2024},{"text":1824,"config":2212},{"href":1826,"dataGaName":1827,"dataGaLocation":2024},{"text":1829,"config":2214},{"href":1831,"dataGaName":1832,"dataGaLocation":2024},{"text":1834,"config":2216},{"href":1836,"dataGaName":1574,"dataGaLocation":2024},{"title":1849,"links":2218},[2219,2221,2223,2225,2227,2229,2233,2238,2240,2242,2244],{"text":1857,"config":2220},{"href":1859,"dataGaName":1851,"dataGaLocation":2024},{"text":1862,"config":2222},{"href":1864,"dataGaName":1865,"dataGaLocation":2024},{"text":1870,"config":2224},{"href":1872,"dataGaName":1873,"dataGaLocation":2024},{"text":1875,"config":2226},{"href":1877,"dataGaName":1878,"dataGaLocation":2024},{"text":1880,"config":2228},{"href":1882,"dataGaName":1883,"dataGaLocation":2024},{"text":2230,"config":2231},"Sustainability",{"href":2232,"dataGaName":2230,"dataGaLocation":2024},"/sustainability/",{"text":2234,"config":2235},"Diversity, inclusion and belonging (DIB)",{"href":2236,"dataGaName":2237,"dataGaLocation":2024},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":1885,"config":2239},{"href":1887,"dataGaName":1888,"dataGaLocation":2024},{"text":1895,"config":2241},{"href":1897,"dataGaName":1898,"dataGaLocation":2024},{"text":1900,"config":2243},{"href":1902,"dataGaName":1903,"dataGaLocation":2024},{"text":2245,"config":2246},"Modern Slavery Transparency Statement",{"href":2247,"dataGaName":2248,"dataGaLocation":2024},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":2250},[2251,2254,2257],{"text":2252,"config":2253},"Terms",{"href":2076,"dataGaName":2077,"dataGaLocation":2024},{"text":2255,"config":2256},"Cookies",{"dataGaName":2086,"dataGaLocation":2024,"id":2087,"isOneTrustButton":1152},{"text":2258,"config":2259},"Privacy",{"href":2081,"dataGaName":2082,"dataGaLocation":2024},[2261],{"id":2262,"title":7,"body":1561,"config":2263,"content":2265,"description":1561,"extension":2269,"meta":2270,"navigation":1152,"path":2271,"seo":2272,"stem":2273,"__hash__":2274},"blogAuthors/en-us/blog/authors/tim-rizzi.yml",{"template":2264},"BlogAuthor",{"name":7,"config":2266},{"headshot":2267,"ctfId":2268},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749661866/Blog/Author%20Headshots/trizzi-headshot.jpg","trizzi","yml",{},"/en-us/blog/authors/tim-rizzi",{},"en-us/blog/authors/tim-rizzi","ADPqrpcnKveFJS0m_zFV0VLtb_h_txu59QVgz_YwKMc",[2276,2284,2292],{"title":2277,"description":2278,"heroImage":2279,"category":1557,"date":2280,"authors":2281,"slug":2283,"externalUrl":1561},"How GitLab tracks vulnerabilities through refactors and reformatting","Learn how GitLab's improved Scope+Offset fingerprinting keeps vulnerability tracking stable across comments, blank lines, and reformatting.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1759320418/xjmqcozxzt4frx0hori3.png","2026-08-12",[2282],"Julian Thome","improved-scope-offset-fingerprinting",{"title":2285,"description":2286,"heroImage":2279,"category":1557,"date":2287,"authors":2288,"slug":2291,"externalUrl":1561},"GitLab Secrets Manager adds ESO, Terraform, API support","Simplify credential management across your stack. GitLab Secrets Manager provides secure retrieval in Kubernetes, Terraform, and external workflows.","2026-08-06",[2289,2290],"Erick Bajao","Joe Randazzo","gitlab-secrets-manager-add-eso-terraform-api-support",{"title":2293,"description":2294,"heroImage":2295,"category":1557,"date":2296,"authors":2297,"slug":2299,"externalUrl":1561},"Secure every commit to production with Claude and GitLab","Claude Security catches vulnerabilities inside a coding session. GitLab picks up from there, scanning, enforcing policy, and producing audit evidence for the software lifecycle. ","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png","2026-08-03",[2298],"Alisa Ho","claude-security-and-gitlab",{"promotions":2301},[2302,2316,2328,2339],{"id":2303,"categories":2304,"header":2306,"text":2307,"button":2308,"image":2313},"ai-modernization",[2305],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":2309,"config":2310},"Get your AI maturity score",{"href":2311,"dataGaName":2312,"dataGaLocation":1790},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":2314},{"src":2315},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":2317,"categories":2318,"header":2320,"text":2307,"button":2321,"image":2325},"devops-modernization",[2319,2125],"product","Are you just managing tools or shipping innovation?",{"text":2322,"config":2323},"Get your DevOps maturity score",{"href":2324,"dataGaName":2312,"dataGaLocation":1790},"/assessments/devops-modernization-assessment/",{"config":2326},{"src":2327},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":2329,"categories":2330,"header":2331,"text":2307,"button":2332,"image":2336},"security-modernization",[1557],"Are you trading speed for security?",{"text":2333,"config":2334},"Get your security maturity score",{"href":2335,"dataGaName":2312,"dataGaLocation":1790},"/assessments/security-modernization-assessment/",{"config":2337},{"src":2338},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":2340,"paths":2341,"header":2344,"text":2345,"button":2346,"image":2351},"github-azure-migration",[2342,2343],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":2347,"config":2348},"See how GitLab compares to GitHub",{"href":2349,"dataGaName":2350,"dataGaLocation":1790},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":2352},{"src":2327},{"header":2354,"blurb":2355,"button":2356,"secondaryButton":2361},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":2357,"config":2358},"Get your free trial",{"href":2359,"dataGaName":1593,"dataGaLocation":2360},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":2062,"config":2362},{"href":1914,"dataGaName":1598,"dataGaLocation":2360},1786803772818]