Ensure pipeline steps produce a Software Bill of Materials (SBOM)

中等級 1人工審核gitlab

說明

SBOM (Software Bill of Materials) is a file that specifies each component of software or a build process. Generate an SBOM after each run of a pipeline. Generating a Software Bill of Materials after each run of a pipeline will validate the integrity and security of that pipeline. Recording every step or component role in the pipeline ensures that no malicious acts have been committed during the pipeline's run.

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

For each pipeline, ensure it produces a Software Bill of Materials on every run. - Check if your gitlab-ci.yml file contains the following: include: - template: Jobs/Dependency-Scanning.gitlab-ci.yml If your project has the following structure: . ├── ruby-project/ │ └── Gemfile.lock ├── ruby-project-2/ │ └── Gemfile.lock ├── php-project/ │ └── composer.lock └── go-project/ └── go.sum Then the Gemnasium scanner generates the following CycloneDX SBOMs: . ├── ruby-project/ │ ├── Gemfile.lock │ └── gl-sbom-gem-bundler.cdx.json ├── ruby-project-2/ │ ├── Gemfile.lock │ └── gl-sbom-gem-bundler.cdx.json ├── php-project/ │ ├── composer.lock │ └── gl-sbom-packagist-composer.cdx.json └── go-project/ ├── go.sum └── gl-sbom-go-go.cdx.json - Review if these files exists in your environment

修補方式

修補方法: 操作指南或基礎設施修補檔

For each pipeline, configure it to produce a Software Bill of Materials on every run. - On the left sidebar, select Search or go to and find your project. - Select Build > Pipeline editor. - If no .gitlab-ci.yml file exists, select Configure pipeline, then delete the example content. - Copy and paste the following to the bottom of the .gitlab-ci.yml file. If an include line already exists, add only the template line below it. include: - template: Jobs/Dependency-Scanning.gitlab-ci.yml - Select the Validate tab, then select Validate pipeline. The message Simulation completed successfully confirms the file is valid. - Select the Edit tab. - Complete the fields. Do not use the default branch for the Branch field. - Select the Start a new merge request with these changes checkbox, then select Commit changes. - Complete the fields according to your standard workflow, then select Create merge request. - Review and edit the merge request according to your standard workflow, then select Merge. The CycloneDX SBOMs are: - Named gl-sbom--.cdx.json. - Available as job artifacts of the dependency scanning job. - Saved in the same directory as the detected lock or build files.

屬性

作業系統: 不限
標籤: ci-cddevsecopsgitlabsbom
參考資料: CIS GitLab Benchmark v1.0.1 - 2.4.5 Ensure pipeline steps produce a Software Bill of Materials (SBOM)