Ensure pipeline steps sign the Software Bill of Materials (SBOM) produced

中级别 1人工审核gitlab

说明

SBOM (Software Bill of Materials) is a file that specifies each component of software or a build process. It should be generated after every pipeline run. After it is generated, it must then be signed. Software Bill of Materials (SBOM) is a file used to validate the integrity and security of a build pipeline. Signing it ensures that no one tampered with the file when it was delivered. Such interference can happen if someone tries to hide unusual activity. Validating the SBOM signature can detect this activity and prevent much greater incident.

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

For each pipeline, ensure it signs the Software Bill of Materials it produces on every run.

修复方式

修复方法: 操作指南或基础设施补丁

For each pipeline, configure it to sign its produced Software Bill of Materials on every run.

属性

操作系统: 任意
标签: ci-cddevsecopsgitlabsbom
参考: CIS GitLab Benchmark v1.0.1 - 2.4.6 Ensure pipeline steps sign the Software Bill of Materials (SBOM) produced