Ensure scanners are in place for open-source license issues in used packages

HighLevel 1Manual reviewsupply-chain

Description

Detect open-source license problems in used dependencies and fix them. A software license is a legal document that establishes several key conditions between a software company or developer and a user in order to allow the use of software. Software licenses have the potential to create code dependencies. Not following the conditions in the software license can also lead to lawsuits. When using packages with a software license, especially commercial ones (which are the most permissive), it is important to verify what is allowed by that license in order to be protected against lawsuits.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

For every package in use, ensure scanners are set to identify open-source license problems.

How it is fixed

Fix method: Guidance or infrastructure patch

For every package in use, designate scanners to identify open-source license problems and fix them. 28 CIS Software Supply Chain Security Guide 2 Build Pipelines This section consists of security recommendations for the management of application build pipelines developed by an organization. Build pipelines are a set of instructions dedicated to taking raw files of source code and running a series of tasks on them to achieve some final artifact as output. This artifact represents the final form of the recent version of software, which is subsequently packaged for convenient storing, handling, and deploying. Build pipelines are a general name for the environment in which this compilation process takes place, the pipeline files that orchestrate the process, and all sets of instructions related to them. 2.1 Build Environment This section consists of security recommendations for the build pipelines environment. Build environment is everything related to the infrastructure of the organization’s artifacts build — the orchestrator, the pipeline executer, where the build workers are running — while pipeline is a set of commands that runs in the build environment. Most of the build enviro...

Properties

Operating systems: Any
Tags: devsecopssupply-chain
Reference: CIS Software Supply Chain Security Guide Benchmark v1.0.0 - 1.5.6 Ensure scanners are in place for open-source license issues in used packages