{"id":139662,"date":"2025-07-22T11:11:56","date_gmt":"2025-07-22T09:11:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/google-predstavil-proekt-oss-rebuild-dlya-vyyavleniya-skrytyh-izmenenij-v-paketah"},"modified":"2025-07-22T11:11:56","modified_gmt":"2025-07-22T09:11:56","slug":"google-predstavil-proekt-oss-rebuild-dlya-vyyavleniya-skrytyh-izmenenij-v-paketah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/google-predstavil-proekt-oss-rebuild-dlya-vyyavleniya-skrytyh-izmenenij-v-paketah","title":{"rendered":"Google tutvustas OSS Rebuild projekti, et avastada varjatud muudatusi pakettides.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Google esitas OSS Rebuild projekti, mille eesm\u00e4rk on tuvastada peidetud muudatusi valmis paketides, mida avaldatakse hoidlates. OSS Rebuildi t\u00f6\u00f6 p\u00f5hineb k\u00fclluslike kogumite kontseptsioonil ja seisneb vastavuse kontrollimises hoidlas olevate pakettide ning referentsallikast, mis vastab paketi deklareeritud versioonile, \u00fcmberkogumise teel saadud pakettide vahel. T\u00f6\u00f6riista kood on kirjutatud Go keeles ja levitatakse Apache 2.0 litsentsi alusel.      <\/p>\n<p>Praegu on OSS Rebuildis rakendatud toetust NPM (JavaScript\/TypeScript), PyPI (Python) ja Crates.io (Rust) hoidlatest pakettide verifitseerimiseks. Tulevikus saab toetatavate hoidlate arvu planeeritakse laiendada. Praktikas v\u00f5imaldab t\u00f6\u00f6riist avastada tarneahela r\u00fcnnaku t\u00fc\u00fcpe, kus p\u00e4rast kaasosaliste kontode kompromiteerimist v\u00f5i projekti sees toimuvaid diversioone avaldatakse hoidlas pahatahtlik v\u00e4rskendus. Samal ajal j\u00e4\u00e4b peamise projekti originaalne kood \u00f5igeks, pahatahtlikud muutused kantakse sisse ainult valmispakettidesse.      <\/p>\n<p>S\u00fcsteem koostab nii palju kui v\u00f5imalik automaatselt stsenaariumi valitud paketi reproduktiivseks koostamiseks, kasutades heuristikameetodeid ja valides parameetreid, mis aitavad saavutada pakettides tarnitud artefaktide identiteeti. Kui hoidlas olevat paketti ei \u00f5nnestu automaatselt replikeerida, on v\u00f5imalik k\u00e4sitsi lisada koostamisspetsifikatsioon. P\u00e4rast paketi reproduktsiooni s\u00e4ilitab OSS Rebuild t\u00f6\u00f6riist koostamise protsessi kirjelduse j\u00e4rgnevate paketi uusversioonide kontrollimiseks. Tooted avaldatakse t\u00e4iendavaks verifitseerimiseks SLSA raamistiku abil.    <\/p>\n<p>Konkreetse paketi versiooni kontrollimise j\u00e4rel genereeritakse tunnustamisandmed, mida saavad teised kasutada juba kontrollitud pakettide hindamiseks. Kontrollimist saab teha kas k\u00e4surea utiliidi kaudu v\u00f5i eraldi pilvehotis salvestatud hash'i kontrollimisega. Pakettide kontrollimise infrastruktuuri saab \u00fcles seada enda <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/et\/server\/dts-dronten\/\"   title=\"serveris\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2583\">serveris<\/a>. Samuti on v\u00f5imalik kasutada teavet Google\u2019is l\u00e4bi viidud kontrollide kohta, mis on tehtud tuhandete pakettide jaoks.        <\/p>\n<p>OSS Rebuild'i kaitseks erinevate r\u00fcnnakute eest toovad n\u00e4iteid, nagu tagavarav\u00f5tme lisamine XZ-sse, pahavara koodi sisestamine ametlikku JavaScripti kliendisse kr\u00fcptovaluutale Solana ja muudatuste sisestamine through Actions'i muudetud failide t\u00f6\u00f6tleja:  <\/p>\n<ul>\n<li class=\"l\"> XZ projekti puhul ei sisaldanud kood repositooriumis kahtlusi, kuid tagavarav\u00f5tme moodustavad pahatahtlikud komponendid tarniti failides, mida kasutati XZ dekompressori korrektsuse testimiseks. Tagavarav\u00f5ti aktiveeriti ehitustasandi tasemel, samas kui XZ l\u00e4htekood kattus repositooriumis oleva koodiga. Tagavarav\u00f5tit aktiveerivad m4-makrod Automake'i t\u00f6\u00f6riistakomplektis oli lisatud ainult valmis arhiivi koos koodiga ning puudusid repositooriumis. Selliste r\u00fcnnakute tuvastamiseks kasutab OSS Rebuild pakettide d\u00fcnaamilist anal\u00fc\u00fcsi, t\u00e4ideviimise teid ja kahtlasi toiminguid.\n<li class=\"l\"> Pahatahtlike muudatuste sisestamine @solana\/web3.js teeki toimus seoses hooldaja konto kompromiteerimisega, kasutades sotsiaalsete petmisv\u00f5tete ja kalap\u00fc\u00fcgi meetodeid. NPM repositooriumis avaldati uus versioon, mis sisaldas pahatahtlikke muudatusi. Projekti Git-repositooriumis seda versiooni ei loodud ja pahatahtlikud muudatused olid kohal ainult tulemuseks olevas paketis. Kaitse k\u00e4esoleval juhul seisneb koodi tuvastamises paketis, mis puudub peamisest repositooriumist.\n<li class=\"l\"> Muudetud failide t\u00f6\u00f6tleja repositooriumi kompromiteerimine v\u00f5imaldas r\u00fcnnakut projektidele, mis kasutavad muudetud faile failide ja kaustade muudatuste j\u00e4lgimiseks GitHub Actions'i pideva integreerimise infrastruktuuris. Kaitseks muudatuste sisestamise eest p\u00e4rast ehituskeskkonna kompromiteerimist rakendab OSS Rebuild muutuste j\u00e4lgimist ja kahtlast tegevust standardiseeritud k\u00e4rbitud ehituskeskkondades.      <\/ul>\n<p>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=63613\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043f\u0440\u043e\u0435\u043a\u0442 OSS Rebuild, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u043a\u0440\u044b\u0442\u044b\u0445 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u0433\u043e\u0442\u043e\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u0430\u0445, \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u0435\u043c\u044b\u0445 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445. \u0420\u0430\u0431\u043e\u0442\u0430 OSS Rebuild \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u0430 \u043d\u0430 \u043a\u043e\u043d\u0446\u0435\u043f\u0446\u0438\u0438 \u0432\u043e\u0441\u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u043c\u044b\u0445 \u0441\u0431\u043e\u0440\u043e\u043a \u0438 \u0441\u0432\u043e\u0434\u0438\u0442\u0441\u044f \u043a \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0435 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u044f \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u043e\u0433\u043e \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 \u0441 \u043f\u0430\u043a\u0435\u0442\u043e\u043c \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u043c \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u043f\u0435\u0440\u0435\u0441\u0431\u043e\u0440\u043a\u0438 \u0438\u0437 \u044d\u0442\u0430\u043b\u043e\u043d\u043d\u043e\u0433\u043e \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430, \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0433\u043e \u0437\u0430\u044f\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u0430. \u041a\u043e\u0434 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f \u043d\u0430\u043f\u0438\u0441\u0430\u043d \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Go \u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-139662","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043f\u0440\u043e\u0435\u043a\u0442 OSS Rebuild, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u043a\u0440\u044b\u0442\u044b\u0445 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u0433\u043e\u0442\u043e\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u0430\u0445, \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u0435\u043c\u044b\u0445 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/google-predstavil-proekt-oss-rebuild-dlya-vyyavleniya-skrytyh-izmenenij-v-paketah\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Google \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b \u043f\u0440\u043e\u0435\u043a\u0442 OSS Rebuild \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u043a\u0440\u044b\u0442\u044b\u0445 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u043f\u0430\u043a\u0435\u0442\u0430\u0445 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043f\u0440\u043e\u0435\u043a\u0442 OSS Rebuild, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u043a\u0440\u044b\u0442\u044b\u0445 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u0433\u043e\u0442\u043e\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u0430\u0445, \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u0435\u043c\u044b\u0445 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/google-predstavil-proekt-oss-rebuild-dlya-vyyavleniya-skrytyh-izmenenij-v-paketah\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2025-07-22T09:11:56+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2025-07-22T09:11:56+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Google tutvustas projekti OSS Rebuild peidetud muudatuste tuvastamiseks pakettides | ProHoster","description":"Google tutvustas projekti OSS Rebuild, mis on m\u00f5eldud peidetud muudatuste tuvastamiseks valmis pakettides, mida avaldatakse repositooriumides.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/google-predstavil-proekt-oss-rebuild-dlya-vyyavleniya-skrytyh-izmenenij-v-paketah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Google \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b \u043f\u0440\u043e\u0435\u043a\u0442 OSS Rebuild \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u043a\u0440\u044b\u0442\u044b\u0445 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u043f\u0430\u043a\u0435\u0442\u0430\u0445 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043f\u0440\u043e\u0435\u043a\u0442 OSS Rebuild, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u043a\u0440\u044b\u0442\u044b\u0445 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u0433\u043e\u0442\u043e\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u0430\u0445, \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u0435\u043c\u044b\u0445 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/google-predstavil-proekt-oss-rebuild-dlya-vyyavleniya-skrytyh-izmenenij-v-paketah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-07-22T09:11:56+00:00","article:modified_time":"2025-07-22T09:11:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"139662","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:11:15","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 13:55:19","updated":"2026-02-09 22:11:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/139662","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=139662"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/139662\/revisions"}],"predecessor-version":[{"id":159865,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/139662\/revisions\/159865"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=139662"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=139662"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=139662"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}