TMA-GITLAB-1.5.6
Ensure scanners are in place for open-source license issues in used packages
Açıklama
Detect open-source license problems in used dependencies and fix them. A software license is a legal document that establishes several key conditions between a software company or developer and a user in order to allow the use of software. Software licenses have the potential to create code dependencies. Not following the conditions in the software license can also lead to lawsuits. When using packages with a software license, especially commercial ones (which are the most permissive), it is important to verify what is allowed by that license in order to be protected against lawsuits.
Nasıl denetlenir
Denetim yöntemi: Manuel inceleme
Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.
Ensure a license scanning tool is set up to identify open-source license problems and that every package you use is scanned by it. - The Dependency Scanning or Container Scanning CI job must be configured for your project. - Your project uses at least one of the languages and package managers supported by Gemnasium. - A successful pipeline was run on the default branch. You should not change the default behavior of allowing the application security jobs to fail. - Review the output from the scan in Secure > Dependency list.
Nasıl düzeltilir
Düzeltme yöntemi: Kılavuz veya altyapı yaması
- The Dependency Scanning or Container Scanning CI job must be configured for your project. - Your project uses at least one of the languages and package managers supported by Gemnasium. - A successful pipeline was run on the default branch. You should not change the default behavior of allowing the application security jobs to fail. - Take necessary actions based on the outcome of the scan in Secure > Dependency list.
Özellikler
- İşletim sistemleri
- Herhangi biri
- Etiketler
- devsecopsgitlab
- Referans
- CIS GitLab Benchmark v1.0.1 - 1.5.6 Ensure scanners are in place for open-source license issues in used packages