{"id":122969,"date":"2025-03-25T10:22:42","date_gmt":"2025-03-25T08:22:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-nixos-predlozhen-metod-zashhity-ot-podstanovki-bekdorov-takih-kak-v-xz"},"modified":"2025-03-25T10:22:42","modified_gmt":"2025-03-25T08:22:42","slug":"v-nixos-predlozhen-metod-zashhity-ot-podstanovki-bekdorov-takih-kak-v-xz","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/v-nixos-predlozhen-metod-zashhity-ot-podstanovki-bekdorov-takih-kak-v-xz","title":{"rendered":"NixOS has proposed a method for protecting against the insertion of backdoors, such as those in XZ.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
To include in the nixpkgs package repository used in the NixOS distribution, a mode of reproducible builds has been proposed, allowing for the detection of instances of backdoor insertion into the code, reminiscent of the incident with the XZ project. The presented protection method enables the detection of modifications in source code archives of the release that are absent in the code repositories. <\/p>\n
The essence of the method is that the source code of the new version of the application is built twice \u2014 first from code uploaded from the git repository, and second from code distributed in ready-made archives. If the resulting binary files differ, it raises suspicions of hidden modifications in the repository or in the archive file containing the code. <\/p>\n
Recall that in the case of the XZ project, the code repository did not contain any suspicious changes. The components forming the backdoor were delivered within files used in the test suite for verifying the unarchiver's correct operation. The backdoor was activated at the build system level, while the source code of XZ matched the code from the repository. The triggering backdoor m4 macros for the Automake toolkit were included only in the finished archive of the code and were absent in the repository. <\/p>\n
The backdoor in XZ was implanted by an attacker who obtained maintainer status in the project. The backdoor insertion went unnoticed immediately because distributions mainly build packages by loading code from ready-made archives, as a single checksum can be used for file integrity verification and mirrors can be utilized when loading code for builds. The primary focus during code verification is on analyzing the repository contents, so non-obvious differences in the archives may not always be detected immediately. <\/p>\n
To simplify the verification of the compliance of archive files and snapshots of the repository corresponding to releases, some open projects, such as PostgreSQL, have implemented a system of reproducible archive generation. In this case, a toolkit is provided that allows you to independently build your archive from the code, fully corresponding to the ready-to-download archive. If the independently created archive differs from the one provided by the main project, it indicates a compromise of the repository or the reference archive. <\/p>\n
The problem is that this method is only practiced in certain cases, while many projects continue to include additional artifacts in the archives that are not present in the main repository, such as man pages, documentation, examples, distribution package creation scripts, and additional build files. This mainly occurs due to historical reasons and the peculiarities of the release formation processes. A simple compliance check between the repository contents and the archive is not suitable in this case. <\/p>\n
As a solution, it is proposed to build release binary files both from the repository (for example, using the automatically generated GitHub archive for the release tag) and from the archive prepared by the maintainer, and then compare the results. As an experiment, the inclusion of such a check has only been suggested for the 'xz' package so far. If the experiment proves successful, the checks are planned to be used in other packages in nixpkgs. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"