curl removed from Omnibus-GitLab FIPS packages in 19.0

GitLab will remove its bundled curl from Omnibus-GitLab FIPS packages beginning with version 19.0 and use the customer’s Linux distribution package instead. The change is driven by curl 8.18.0 dropping support for OpenSSL 1.x and extends GitLab’s existing approach of relying on distribution-provided cryptographic libraries. GitLab instances should continue working normally, but customers will become responsible for keeping curl updated.

Change to FIPS Packages

• Starting with Omnibus-GitLab 19.0, FIPS packages will no longer include a GitLab-built curl.
• The package will use curl supplied by the customer’s Linux distribution.
• The change applies to all FIPS customers and will also be included in patch releases for existing supported versions.
• GitLab 19.0 is scheduled for May 21, 2026.

Why GitLab Is Making the Change

• curl 8.18.0 deprecated compilation against OpenSSL 1.x.
• This prevents GitLab’s previous curl-building approach on:
  • Amazon Linux 2
  • AlmaLinux 8
  • RHEL 8 environments
• FIPS packages already use distribution-provided OpenSSL rather than bundled cryptographic libraries.
• GitLab is extending that model to curl for maintainability and security, including on systems using OpenSSL 3.0 or newer.

Customer Responsibilities

• No immediate configuration or migration action is required.
• Customers must keep their operating system’s curl package updated to receive security fixes.
• Security scanners will report the host OS curl version instead of a GitLab-bundled version.
• GitLab will no longer ship curl-specific security updates for FIPS packages.

Customers experiencing problems should report them in the Omnibus-GitLab issue tracker.