Ensure a signed Software Bill of Materials (SBOM) of the code is supplied

ÉlevéeNiveau 1Revue manuellegithub

Description

A Software Bill of Materials (SBOM) is a file that specifies each component of software or a build process. When using a dependency, demand its SBOM and ensure it is signed for validation purposes. A Software Bill of Materials (SBOM) creates trust between its provider and its users by ensuring that the software supplied is the software described, without any potential interference in between. Reported as a manual review item: no reliable read-only gh api check exists for this control.

Méthode de vérification

Méthode d'audit: Revue manuelle

Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.

For every artifact supplied, ensure it has a validated, signed Software Bill of Materials. Expected state: For every artifact supplied, require and verify a signed Software Bill of Materials from its supplier.

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

For every artifact supplied, require and verify a signed Software Bill of Materials from its supplier.

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: githubdependencies
Référence: CIS GitHub Benchmark v1.2.0 - 3.1.6 Ensure a signed Software Bill of Materials (SBOM) of the code is supplied