V-285676

Discussion

Software obtained from repositories or external sources may be modified, corrupted, or replaced by malicious content if integrity protections are not enforced. Failure to verify package authenticity prior to installation may allow unauthorized or altered software to be introduced into the operating system environment. Cryptographic verification mechanisms, such as package signature validation, provide assurance that software originates from trusted sources and has not been modified since publication. The operating system must validate software authenticity and integrity before installation or update to reduce the risk of introducing malicious or unauthorized code.

Check Content

Verify the operating system validates software package signatures before installation or update.

1. Access the system using a privileged account and run:

grep -i "^gpgcheck" /etc/zypp/zypp.conf

2. Verify the output returns:

gpgcheck = on

If gpgcheck is disabled, missing, commented out, or configured with a value other than on, this is a finding.