Ensure packages are obtained from authorized repositories

MediumLevel 1Manual reviewyugabytedb

Description

Standard Linux distributions, although possessing the requisite packages, often do not have YugabyteDB pre-installed. The installation process includes installing the binaries and the means to generate a data cluster. Package installation should include both the server and client packages. Contribution modules are optional depending upon one's architectural requirements (they are recommended though).

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Inspect the configured package repositories and download sources: YugabyteDB packages must come only from software.yugabyte.com (or an approved internal mirror of it). Verify each installation archive against the published checksum (e.g. sha1sum <archive> compared with <archive URL>.sha); any other source or a mismatch is a finding.

How it is fixed

Fix method: Guidance or infrastructure patch

Alter the configured repositories so they only include valid and authorized sources of packages. #!/bin/bash # URL of the file to download FILE_URL="https://software.yugabyte.com/releases/2025.2.4.0/yugabyte- 2025.2.4.0-b122-linux-x86_64.tar.gz" # Download the file wget $FILE_URL

Properties

Operating systems: Any
Tags: yugabytedbsupply-chain
Reference: CIS YugabyteDB Benchmark v2.0.0 - 1.1 Ensure packages are obtained from authorized repositories