Ensure trusted package managers and repositories are defined and prioritized

OrtaDüzey 1Manuel incelemegitlab

Açıklama

Prioritize trusted package registries over others when pulling a package. When pulling a package by name, the package manager might look for it in several package registries, some of which may be untrusted or badly configured. If the package is pulled from such a registry, there is a higher likelihood that it could prove malicious. In order to avoid this, configure packages to be pulled from trusted package registries.

Nasıl denetlenir

Denetim yöntemi: Manuel inceleme

Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.

For each package registry in use, ensure it is trusted. The GitLab package registry is enabled by default.

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

For each package to be downloaded, configure it to be downloaded from a trusted source. To view your GitLab package registry and its contents, click on "Deploy" --> "Package Registry."

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: devsecopsgitlab
Referans: CIS GitLab Benchmark v1.0.1 - 3.1.5 Ensure trusted package managers and repositories are defined and prioritized