TMA-GITLAB-1.5.6
Ensure scanners are in place for open-source license issues in used packages
Beschreibung
Detect open-source license problems in used dependencies and fix them. A software license is a legal document that establishes several key conditions between a software company or developer and a user in order to allow the use of software. Software licenses have the potential to create code dependencies. Not following the conditions in the software license can also lead to lawsuits. When using packages with a software license, especially commercial ones (which are the most permissive), it is important to verify what is allowed by that license in order to be protected against lawsuits.
So wird geprüft
Prüfmethode: Manuelle Prüfung
Diese Empfehlung kann nicht automatisch geprüft werden. Ein Scan führt sie mit diesen Anweisungen auf, wenn Sie --include-manual übergeben.
Ensure a license scanning tool is set up to identify open-source license problems and that every package you use is scanned by it. - The Dependency Scanning or Container Scanning CI job must be configured for your project. - Your project uses at least one of the languages and package managers supported by Gemnasium. - A successful pipeline was run on the default branch. You should not change the default behavior of allowing the application security jobs to fail. - Review the output from the scan in Secure > Dependency list.
So wird behoben
Behebungsmethode: Anleitung oder Infrastruktur-Patch
- The Dependency Scanning or Container Scanning CI job must be configured for your project. - Your project uses at least one of the languages and package managers supported by Gemnasium. - A successful pipeline was run on the default branch. You should not change the default behavior of allowing the application security jobs to fail. - Take necessary actions based on the outcome of the scan in Secure > Dependency list.
Eigenschaften
- Betriebssysteme
- Beliebig
- Tags
- devsecopsgitlab
- Referenz
- CIS GitLab Benchmark v1.0.1 - 1.5.6 Ensure scanners are in place for open-source license issues in used packages