Ensure scanners are in place for open-source license issues in used packages

보통레벨 2수동 검토gitlab

설명

Detect open-source license problems in used dependencies and fix them. A software license is a legal document that establishes several key conditions between a software company or developer and a user in order to allow the use of software. Software licenses have the potential to create code dependencies. Not following the conditions in the software license can also lead to lawsuits. When using packages with a software license, especially commercial ones (which are the most permissive), it is important to verify what is allowed by that license in order to be protected against lawsuits.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Ensure a license scanning tool is set up to identify open-source license problems and that every package you use is scanned by it. - The Dependency Scanning or Container Scanning CI job must be configured for your project. - Your project uses at least one of the languages and package managers supported by Gemnasium. - A successful pipeline was run on the default branch. You should not change the default behavior of allowing the application security jobs to fail. - Review the output from the scan in Secure > Dependency list.

조치 방법

조치 방식: 가이드 또는 인프라 패치

- The Dependency Scanning or Container Scanning CI job must be configured for your project. - Your project uses at least one of the languages and package managers supported by Gemnasium. - A successful pipeline was run on the default branch. You should not change the default behavior of allowing the application security jobs to fail. - Take necessary actions based on the outcome of the scan in Secure > Dependency list.

속성

운영 체제: 모두
태그: devsecopsgitlab
참고 자료: CIS GitLab Benchmark v1.0.1 - 1.5.6 Ensure scanners are in place for open-source license issues in used packages