TMA-GITLAB-4.4.1

Ensure artifacts contain information about their origin

中レベル 1手動レビューgitlab

説明

When delivering artifacts, ensure they have information about their origin. This may be done by providing a Software Bill of Manufacture (SBOM) or some metadata files. Information about artifact origin can be used for verification purposes. Having this kind of information allows the user to decide if the organization supplying the artifact is trusted. In a case of potential vulnerability or version update, this can be used to verify that the organization issuing it is the actual origin and not someone else. If users need to report problems with the artifact, they will have an address to contact as well.

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

For each artifact, ensure it has information about its origin.

修正方法

修正方法: ガイダンスまたは IaC パッチ

For each artifact supplied, supply information about its origin. For each artifact in use, ask for information about its origin.

プロパティ

オペレーティングシステム: すべて
タグ: devsecopsgitlab
参照: CIS GitLab Benchmark v1.0.1 - 4.4.1 Ensure artifacts contain information about their origin