Obtain the binary from an official and trusted source and verify the SHA-256 sum after downloading

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

Review CI/CD pipelines, configuration-management code and install scripts: CockroachDB artifacts must be downloaded only from https://binaries.cockroachdb.com/ (or an internal mirror synced exclusively from it). For deployed versions, compare sha256sum of the downloaded archive with the published .sha256sum file; any other source or a checksum mismatch is a finding.

修正方法

修正方法: ガイダンスまたは IaC パッチ

1. Reconfigure package pipelines Update all package managers, automation scripts, and manual runbooks to download CockroachDB binaries and tools only from: - https://binaries.cockroachdb.com/, or - A vetted internal mirror that pulls from this official source. 2. Download CockroachDB from official source and verify checksum #Example: Linux ARM64;