The GitLab signing credential¶
Every claim, accept, reject, approval, and close in GitLab runs as the person doing it. To make that possible, Attest is registered once as an application in GitLab, and each reviewer consents once.
Register the application¶
Register the application at the group level rather than under a personal account, so it survives staff changes. In GitLab, open the group, then Settings, then Applications.
| Field | Value |
|---|---|
| Name | CYBO Attest |
| Redirect URI | https://<your attest host>/auth/callback, exact match |
| Confidential | Checked. The server holds the secret. |
| Scopes | api |
Save and copy the application id and the secret. The secret shows once; renew it in the same screen if it is lost.
Configure the service¶
GITLAB_OAUTH_CLIENT_ID=<application id>
GITLAB_OAUTH_SECRET=<secret>
GITLAB_OAUTH_REDIRECT=https://<your attest host>/auth/callback
Arm approvals¶
Approvals ship in dry run. The first approval a reviewer records in a new deployment is logged and not performed, so you can confirm the identity and the merge request are right. Set CDSO_APPROVE=live to arm real approvals once that reads correctly.
What the person sees¶
The first time a reviewer claims or decides, the console offers Connect GitLab. GitLab's own consent screen appears once. Where GitLab federates to the same identity provider, no password is entered anywhere. From then on, actions run on the person's own short lived token, refreshed by the server, and GitLab enforces its permissions regardless of console role.
A reviewer can disconnect from the profile menu. That revokes only this application's access for that person; their console session survives.
Rotation and revocation¶
Renew the secret in GitLab, update the configuration, redeploy. Revoking the application in GitLab signs everyone out of the GitLab half instantly; console sessions are unaffected.
The fleet read token¶
Separately from the signing credential, Attest reads the fleet with a project owned read_api token. It has no human identity, cannot write anywhere, and is the only credential the service holds on its own behalf.
GITLAB_TOKEN=<project owned read_api token>
SECURITY_ROOT=<group path under which security repositories are discovered>
Security repositories under SECURITY_ROOT are discovered on each refresh; an explicit list can be added with SECURITY_PROJECTS. Discovered repositories are listed on the health endpoint.
Non negotiables¶
- No bot ever approves on behalf of anyone.
- Humans hold zero long lived keys.
- HTTPS is required before any user token exists in the deployment.