Gitlab push mirroring security

DevSecOps
1

:hugs: Please help fill in this template with all the details to help others help you more efficiently. Use formatting blocks for code, config, logs and ensure to remove sensitive data.

Problem to solve

I’m researching the use of Gitlab → Github push mirroring and cant find any detail on the related security controls. There is a reference to the authentication that can use either username/password or SSH keys but no reference to how the data is copied and whether it is encrypted

Does anyone know of any technical documentation other than the standard Gitlab links?

  • Self-managed
  • Dedicated
  • Self-hosted Runners

Versions

  • GitLab (Web: /help or self-managed system information sudo gitlab-rake gitlab:env:info):
  • GitLab Runner, if self-hosted (Web /admin/runners or CLI gitlab-runner --version):

Helpful resources

  1. Check the FAQ for helpful documentation, issues/bugs/feature proposals, and troubleshooting tips.
  2. Before opening a new topic, make sure to search for keywords in the forum search
  3. Check the GitLab and GitLab Runner projects for existing issues. If you encounter a bug, please create a bug report issue.
  4. Review existing troubleshooting docs.

Thanks for taking the time to be thorough in your request, it really helps! :blush:

2

The source code of GitLab is open-source, with exceptions for proprietary Enterprise open core functionality, but still public. Mirror · Search · GitLab

The development guides provide a good start, too. Application secrets | GitLab Docs → Secure coding development guidelines | GitLab Docs