TMA-GITHUB-2.4.1
Ensure all artifacts on all releases are signed
Description
Sign all artifacts in all releases with user or organization keys. Signing artifacts is used to validate both their integrity and security. Organizations signal that artifacts may be trusted and they themselves produced them by ensuring that every artifact is properly signed. Reported as a manual review item: no reliable read-only gh api check exists for this control.
Méthode de vérification
Méthode d'audit: Revue manuelle
Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.
Ensure every artifact in every release is signed. Expected state: For every artifact in every release, verify that all are properly signed.
Méthode de correction
Méthode de correction: Recommandation ou correctif d'infrastructure
For every artifact in every release, verify that all are properly signed.
Propriétés
- Systèmes d'exploitation
- Tous
- Étiquettes
- githubbuild-pipelines
- Référence
- CIS GitHub Benchmark v1.2.0 - 2.4.1 Ensure all artifacts on all releases are signed