TMA-GITLAB-1.5.6
Ensure scanners are in place for open-source license issues in used packages
Opis
Detect open-source license problems in used dependencies and fix them. A software license is a legal document that establishes several key conditions between a software company or developer and a user in order to allow the use of software. Software licenses have the potential to create code dependencies. Not following the conditions in the software license can also lead to lawsuits. When using packages with a software license, especially commercial ones (which are the most permissive), it is important to verify what is allowed by that license in order to be protected against lawsuits.
Kako se proverava
Metod provere: Ručni pregled
Ova preporuka se ne može proveriti automatski. Skeniranje je navodi sa ovim uputstvima kada prosledite --include-manual.
Ensure a license scanning tool is set up to identify open-source license problems and that every package you use is scanned by it. - The Dependency Scanning or Container Scanning CI job must be configured for your project. - Your project uses at least one of the languages and package managers supported by Gemnasium. - A successful pipeline was run on the default branch. You should not change the default behavior of allowing the application security jobs to fail. - Review the output from the scan in Secure > Dependency list.
Kako se ispravlja
Metod ispravke: Smernica ili zakrpa infrastrukture
- The Dependency Scanning or Container Scanning CI job must be configured for your project. - Your project uses at least one of the languages and package managers supported by Gemnasium. - A successful pipeline was run on the default branch. You should not change the default behavior of allowing the application security jobs to fail. - Take necessary actions based on the outcome of the scan in Secure > Dependency list.
Svojstva
- Operativni sistemi
- Bilo koji
- Oznake
- devsecopsgitlab
- Referenca
- CIS GitLab Benchmark v1.0.1 - 1.5.6 Ensure scanners are in place for open-source license issues in used packages