Ensure artifacts contain information about their origin

MoyenneNiveau 1Revue manuellegithub

Description

When delivering artifacts, ensure they have information about their origin. This may be done by providing a Software Bill of Manufacture (SBOM) or some metadata files. Information about artifact origin can be used for verification purposes. Having this kind of information allows the user to decide if the organization supplying the artifact is trusted. Reported as a manual review item: no reliable read-only gh api check exists for this control.

Méthode de vérification

Méthode d'audit: Revue manuelle

Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.

For each artifact, ensure it has information about its origin. Expected state: For each artifact supplied, supply information about its origin. For each artifact in use, ask for information about its origin.

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

For each artifact supplied, supply information about its origin. For each artifact in use, ask for information about its origin.

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: githubartifacts
Référence: CIS GitHub Benchmark v1.2.0 - 4.4.1 Ensure artifacts contain information about their origin