Ensure scanners are in place for open-source license issues in used packages

中等級 2人工審核gitlab

說明

Detect open-source license problems in used dependencies and fix them. A software license is a legal document that establishes several key conditions between a software company or developer and a user in order to allow the use of software. Software licenses have the potential to create code dependencies. Not following the conditions in the software license can also lead to lawsuits. When using packages with a software license, especially commercial ones (which are the most permissive), it is important to verify what is allowed by that license in order to be protected against lawsuits.

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

Ensure a license scanning tool is set up to identify open-source license problems and that every package you use is scanned by it. - The Dependency Scanning or Container Scanning CI job must be configured for your project. - Your project uses at least one of the languages and package managers supported by Gemnasium. - A successful pipeline was run on the default branch. You should not change the default behavior of allowing the application security jobs to fail. - Review the output from the scan in Secure > Dependency list.

修補方式

修補方法: 操作指南或基礎設施修補檔

- The Dependency Scanning or Container Scanning CI job must be configured for your project. - Your project uses at least one of the languages and package managers supported by Gemnasium. - A successful pipeline was run on the default branch. You should not change the default behavior of allowing the application security jobs to fail. - Take necessary actions based on the outcome of the scan in Secure > Dependency list.

屬性

作業系統: 不限
標籤: devsecopsgitlab
參考資料: CIS GitLab Benchmark v1.0.1 - 1.5.6 Ensure scanners are in place for open-source license issues in used packages