By default, the JWT decode only allows HS256 mode (HMAC using SHA-256
hash algorithm). The specs using RSA tokens failed per
https://github.com/jwt/ruby-jwt#algorithms-and-usage:
It is strongly recommended that you hard code the algorithm, as you may
leave yourself vulnerable by dynamically picking the algorithm.
* upstream/master: (184 commits)
Fix issues with pdf-js dependencies
fix missing changelog entries for security release on 2017-01-23
Update top bar issues icon
Fix pipeline icon in contextual nav for projects
Since mysql is not a priority anymore, test it less
Fix order of CI lint ace editor loading
Add container registry and spam logs icons
Fix different Markdown styles
Backport to CE for:
Make new dropdown dividers full width
Fix spec
Fix spec
Fix spec
Bump GITLAB_SHELL_VERSION and GITALY_VERSION to support unhiding refs
Add changelog
Install yarn via apt in update guides
Use long curl options
fix
Add a spec for concurrent process
Remove monkey-patched Array.prototype.first() and last() methods
...
* upstream/master: (3161 commits)
Derive project path from import URL
add article to list
link to CI/CD Deep Dive demo for #5800
Add code review guidelines related to Build [CI skip].
Make time span dropdown style on cycle analytics page consistent
copyedit, add article to the list
Make Markdown autocomplete dropdown style consistent
Add 204. Remove duplicated method.
Make sure we didn't commit conflicts
Fix bug in blob test
Always fetch branches before finding the merge base, otherwise we could find an outdated merge base
Fixes dropdown margin in sidebar
Fixes the search losing focus
Docs add blog articles
Inline script cleanup globals and easy
Add option to use CommitLanguages RPC
CI fixes for gitaly-ruby
fix
Allow logged in users to read user list under public restriction
Small refactor in LegacyNamespace and moved back send_update_instructions
...
Because we do not have yet two way communication between container
registry and GitLab, we need to eagerly create a new container
repository objects in database. We now do that after user/build
successfully authenticates a push action using auth service.
Thong Kuah
Peter Bábics
Stan Hu
Marcel Amirault
Kamil Trzciński
Mark Chao
Lin Jen-Shin
Mayra Cabrera
Dmitriy Zaporozhets
Vratislav Kalenda
Robert Speicher
Maxime Visonneau
Gabriel Mazetto
Rémy Coutable
Jean Praloran
Grzegorz Bizon
Douwe Maan