Ensure scanners are in place for open-source license issues in used packages

높음레벨 1수동 검토supply-chain

설명

Detect open-source license problems in used dependencies and fix them. A software license is a legal document that establishes several key conditions between a software company or developer and a user in order to allow the use of software. Software licenses have the potential to create code dependencies. Not following the conditions in the software license can also lead to lawsuits. When using packages with a software license, especially commercial ones (which are the most permissive), it is important to verify what is allowed by that license in order to be protected against lawsuits.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

For every package in use, ensure scanners are set to identify open-source license problems.

조치 방법

조치 방식: 가이드 또는 인프라 패치

For every package in use, designate scanners to identify open-source license problems and fix them. 28 CIS Software Supply Chain Security Guide 2 Build Pipelines This section consists of security recommendations for the management of application build pipelines developed by an organization. Build pipelines are a set of instructions dedicated to taking raw files of source code and running a series of tasks on them to achieve some final artifact as output. This artifact represents the final form of the recent version of software, which is subsequently packaged for convenient storing, handling, and deploying. Build pipelines are a general name for the environment in which this compilation process takes place, the pipeline files that orchestrate the process, and all sets of instructions related to them. 2.1 Build Environment This section consists of security recommendations for the build pipelines environment. Build environment is everything related to the infrastructure of the organization’s artifacts build — the orchestrator, the pipeline executer, where the build workers are running — while pipeline is a set of commands that runs in the build environment. Most of the build enviro...

속성

운영 체제: 모두
태그: devsecopssupply-chain
참고 자료: CIS Software Supply Chain Security Guide Benchmark v1.0.0 - 1.5.6 Ensure scanners are in place for open-source license issues in used packages