{"id":114665,"date":"2024-03-30T12:25:45","date_gmt":"2024-03-30T10:25:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/retrospektiva-prodvizheniya-bekdora-v-paket-xz"},"modified":"2024-03-30T12:25:45","modified_gmt":"2024-03-30T10:25:45","slug":"retrospektiva-prodvizheniya-bekdora-v-paket-xz","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/retrospektiva-prodvizheniya-bekdora-v-paket-xz","title":{"rendered":"Tagasivaade tagavarapoolse sisselogimise levikule pakendis xz","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Eeldatavasti on xz paketti tagauksed sisse viinud arendaja Jia Tan, kes sai 2022. aastal hooldaja staatuse ja v\u00e4ljastas versioonidest alates 5.4.2. Lisaks projekti xz on v\u00e4idetav tagaukse autor osalenud ka xz-java ja xz-embedded pakettide arendamises ning kuulunud XZ Embedded projekti hooldajate hulka, mida kasutatakse Linuxi tuumas. <\/p>\n

Taustal on m\u00e4rgatud, et organisatsiooni edendamisel osalesid veel kaks isikut \u2014 Jigar Kumar ja Hans Jansen, kes n\u00e4ivad olevat virtuaalsed tegelased. Jigar Kumar aitas aprillis 2022 kaasa xz varaste pat\u0161ide vastuv\u00f5tmisele Jia Tan'ilt, sealhulgas reafilterite toe rakendamisele ning avaldas moraalset survet Lasse Collinile, tol hetkel toele, kritiseerides, et ta ei suuda oma kohustusi t\u00e4ita ning ei v\u00f5ta vastu kasulikke pat\u0161e. Juunis n\u00f5ustus Lasse Collin, et projekt vajab uut toimetajat, kaebas v\u00e4simuse ja vaimse tervise probleemide \u00fcle ning edastas toimetuse \u00f5igused Jia Tan'ile. P\u00e4rast seda ei ole kasutaja Jigar Kumar enam edastusloendis ilmnenud. <\/p>\n

Saades hooldaja \u00f5igused, hakkas Jia Tan aktiivselt projekti muudatusi lisama ning statistika kohaselt saavutas ta kahe aasta jooksul arendajate hulgas muudatuste arvu j\u00e4rgi teise koha. M\u00e4rtsis 2023 asendati xz paketi testimise eest vastutav isik teenuses oss-fuzz Lasse Colliniga Jia Taniga ning juunis v\u00f5eti xz-sse vastu muudatused, mis lisavad liblzma IFUNC mehhanismi toe (crc64_fast konstruktor asendati ifunciga), mida hiljem kasutati tagaukse funktsioonide \u00fclev\u00f5tmiseks. Muudatuse pakkus v\u00e4lja Hans Jansen ja Jia Tan v\u00f5ttis selle vastu xz-sse. Hans Janseni konto loodi otse enne pull-p\u00e4ra saatmist. <\/p>\n

Juulis 2023 saatis Jia Tan oss-fuzz arendajatele taotluse ifunc'i kontrolli keelamiseks, kuna see ei olnud \u00fchilduv re\u017eiimiga \u201e-fsanitize=address\u201c. 2024. aasta veebruari alguses muudeti projekti veebisaidi link oss-fuzz'is ja peamisel lehelt tukaani.org, muutes selle t\u00fckist \u201etukaani.org\/xz\/\u201c t\u00fckkideks \u201exz.tukaani.org\u201c, kus alamdomeen \u201exz.tukaani.org\u201c oli majutatud GitHub Pages teenuses ja seda valdas isiklikult Jia Tan. 23. veebruaril pandi xz hoidlasse testimiseks dekoodri t\u00f6\u00f6d toetavad arhiivid, sealhulgas failid bad-3-corrupt_lzma2.xz ja good-large_compressed.lzma koos peidetud tagauksega. M4-makrosid, mis aktiveerisid tagaukse, sisaldati ainult 5.6.0 versiooni tar-arhiivis ning need j\u00e4eti Git hoidlast v\u00e4lja, ent ilmusid .gitignore failis. <\/p>\n

17. m\u00e4rtsil registreeriti Hans Jansen, kes oli varem v\u00e4lja t\u00f6\u00f6tanud IFUNC-i toetavad parandused, Debian projekti osalisena, ja 25. m\u00e4rtsil saatis ta palve xz-utils paketi versiooni v\u00e4rskendamiseks Debian hoidlas. Versiooni v\u00e4rskendamise palveid saadeti ka Fedora ja Ubuntu arendajatele (Ubuntu hoidla oli j\u00e4\u00e4ges, mist\u00f5ttu muudatus l\u00fckati tagasi). <\/p>\n

Palvetele v\u00e4rskendada xz versiooni lisandusid m\u00f5ned kasutajad, kes v\u00e4itsid, et uues versioonis on k\u00f5rvaldatud t\u00f6\u00f6d segavad t\u00f5rked, mis ilmnesid valgrindis silumise k\u00e4igus (probleemid tekkisid tagaukse t\u00f6\u00f6tleja virnastamise vale m\u00e4\u00e4ratlemise t\u00f5ttu ja need probleemid p\u00fc\u00fcdsid tagaukse arendajad lahendada versioonis xz 5.6.1). T\u00f5rkest sai huvitavaks ka Andres Freund, Microsofti t\u00f6\u00f6taja, kes osaleb PostgreSQL-i arenduses, kes avastas tagaukseni ja teavitas sellest kogukonda.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0431\u044d\u043a\u0434\u043e\u0440 \u0432 \u043f\u0430\u043a\u0435\u0442 xz \u0431\u044b\u043b \u0432\u043d\u0435\u0434\u0440\u0451\u043d \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u043c Jia Tan, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432 2022 \u0433\u043e\u0434\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u0441\u0442\u0430\u0442\u0443\u0441 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0435\u0433\u043e \u0438 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u043b \u0440\u0435\u043b\u0438\u0437\u044b \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 5.4.2. \u041f\u043e\u043c\u0438\u043c\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u0430 xz \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u043c\u044b\u0439 \u0430\u0432\u0442\u043e\u0440 \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0442\u0430\u043a\u0436\u0435 \u0443\u0447\u0430\u0441\u0442\u0432\u043e\u0432\u0430\u043b \u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 xz-java \u0438 xz-embedded, \u0438 \u0431\u044b\u043b \u0432\u043a\u043b\u044e\u0447\u0451\u043d \u0432 \u0447\u0438\u0441\u043b\u043e \u043c\u044d\u0439\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 XZ Embedded, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0432 \u044f\u0434\u0440\u0435 Linux. \u0412 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114665","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Tagaukse edendamise retrospektiiv paketi xz | ProHoster","description":"Eeldatavasti sisestati tagauks paketti xz arendaja Jia Tan, kes sai 2022. aastal hooldaja staatuse ja v\u00e4ljastas v\u00e4ljalaske alates versioonist 5.4.2.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/retrospektiva-prodvizheniya-bekdora-v-paket-xz","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u0442\u0440\u043e\u0441\u043f\u0435\u043a\u0442\u0438\u0432\u0430 \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0432 \u043f\u0430\u043a\u0435\u0442 xz | ProHoster","og:description":"\u041f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0431\u044d\u043a\u0434\u043e\u0440 \u0432 \u043f\u0430\u043a\u0435\u0442 xz \u0431\u044b\u043b \u0432\u043d\u0435\u0434\u0440\u0451\u043d \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u043c Jia Tan, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432 2022 \u0433\u043e\u0434\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u0441\u0442\u0430\u0442\u0443\u0441 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0435\u0433\u043e \u0438 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u043b \u0440\u0435\u043b\u0438\u0437\u044b \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 5.4.2.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/retrospektiva-prodvizheniya-bekdora-v-paket-xz","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-30T10:25:45+00:00","article:modified_time":"2024-03-30T10:25:45+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/114665","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=114665"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/114665\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=114665"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=114665"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=114665"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}