Obtain the binary from an official and trusted source and verify the SHA-256 sum after downloading

MediaNivel 1Revisión manualcockroachdb

Descripción

CockroachDB server binaries and supporting tools must be obtained only from official Cockroach Labs release sources and verified using the published SHA-256 checksum before installation. The canonical sources for CockroachDB self-hosted binaries are: - The CockroachDB Releases pages, which link to official versioned binaries.

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

Review CI/CD pipelines, configuration-management code and install scripts: CockroachDB artifacts must be downloaded only from https://binaries.cockroachdb.com/ (or an internal mirror synced exclusively from it). For deployed versions, compare sha256sum of the downloaded archive with the published .sha256sum file; any other source or a checksum mismatch is a finding.

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

1. Reconfigure package pipelines Update all package managers, automation scripts, and manual runbooks to download CockroachDB binaries and tools only from: - https://binaries.cockroachdb.com/, or - A vetted internal mirror that pulls from this official source. 2. Download CockroachDB from official source and verify checksum #Example: Linux ARM64;

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: cockroachdbsupply-chain
Referencia: CIS CockroachDB v25.x Benchmark v1.0.0 - 1.1 Obtain the binary from an official and trusted source and verify the SHA-256 sum after downloading