Ensure artifacts contain information about their origin

中等級 1人工審核gitlab

說明

When delivering artifacts, ensure they have information about their origin. This may be done by providing a Software Bill of Manufacture (SBOM) or some metadata files. Information about artifact origin can be used for verification purposes. Having this kind of information allows the user to decide if the organization supplying the artifact is trusted. In a case of potential vulnerability or version update, this can be used to verify that the organization issuing it is the actual origin and not someone else. If users need to report problems with the artifact, they will have an address to contact as well.

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

For each artifact, ensure it has information about its origin.

修補方式

修補方法: 操作指南或基礎設施修補檔

For each artifact supplied, supply information about its origin. For each artifact in use, ask for information about its origin.

屬性

作業系統: 不限
標籤: devsecopsgitlab
參考資料: CIS GitLab Benchmark v1.0.1 - 4.4.1 Ensure artifacts contain information about their origin