TMA-GITLAB-4.2.1
Ensure the authority to certify artifacts is limited
Description
Software certification is used to verify the safety of certain software usage and to establish trust between the supplier and the consumer. Any artifact can be certified. Limit the authority to certify different artifacts. Artifact certification is a powerful tool in establishing trust. Clients use a software certificate to verify that the artifact is safe to use according to their security policies. Because of this, certifying artifacts is considered sensitive. If an artifact is for debugging or internal use, or if it were compromised, the organization would not want certification. An attacker gaining access to both certificate authority and the artifact registry might also be able to certify its own artifact and cause a major breach. To prevent these issues, limit which artifacts can be certified by which platform so there will be minimal access to certification.
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
Ensure only certain artifacts can be certified by certain parties.
How it is fixed
Fix method: Guidance or infrastructure patch
Limit which artifact can be certified by which authority.
Properties
- Operating systems
- Any
- Tags
- authdevsecopsgitlab
- Reference
- CIS GitLab Benchmark v1.0.1 - 4.2.1 Ensure the authority to certify artifacts is limited