{"id":122969,"date":"2025-03-25T10:22:42","date_gmt":"2025-03-25T08:22:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-nixos-predlozhen-metod-zashhity-ot-podstanovki-bekdorov-takih-kak-v-xz"},"modified":"2025-03-25T10:22:42","modified_gmt":"2025-03-25T08:22:42","slug":"v-nixos-predlozhen-metod-zashhity-ot-podstanovki-bekdorov-takih-kak-v-xz","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/v-nixos-predlozhen-metod-zashhity-ot-podstanovki-bekdorov-takih-kak-v-xz","title":{"rendered":"N\u00eb NixOS \u00ebsht\u00eb propozuar nj\u00eb metod\u00eb mbrojtjeje nga z\u00ebvend\u00ebsimet e backdoor-\u00ebve, t\u00eb tilla si n\u00eb XZ.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
P\u00ebr inkludimin n\u00eb depozit\u00ebn e paketave nixpkgs, e p\u00ebrdorur n\u00eb distributin NixOS, \u00ebsht\u00eb propozuar nj\u00eb regjimi i nd\u00ebrtimit t\u00eb p\u00ebrs\u00ebritur, i cili lejon identifikimin e rasteve t\u00eb inkursionit t\u00eb backdoor\u00ebve n\u00eb kod, t\u00eb ngjash\u00ebm me incidentin me projektin XZ. Metoda e prezantuar e mbrojtjes lejon zbulimin e modifikimeve n\u00eb arhivat me kodin burimor t\u00eb versionit q\u00eb mungojn\u00eb n\u00eb depozitat me kod. <\/p>\n
The essence of the method is that the source code of the new version of the application is assembled twice \u2014 the first time from the code loaded from the git repository, and the second from the code distributed in ready-made archives. If the resulting binary files differ, it raises suspicions of hidden modifications in the repository or in the archive file containing the code. <\/p>\n
T\u00eb kujtojm\u00eb se n\u00eb rastin e projektit XZ, depozita e kodit nuk p\u00ebrmbante ndryshime t\u00eb dyshimta. Komponent\u00ebt q\u00eb formonin backdoor-in u shp\u00ebrndan\u00eb brenda skedar\u00ebve t\u00eb p\u00ebrdorur n\u00eb paket\u00ebn e testimit p\u00ebr t\u00eb verifikuar funksionalitetin e shp\u00ebrndar\u00ebsit XZ. Backdoor-i u aktivizua n\u00eb nivelin e sistemit t\u00eb nd\u00ebrtimit, dhe vet\u00eb kodi burimor i XZ ishte i nj\u00ebjt\u00eb me kodin n\u00eb depozit\u00eb. Makrosat m4 q\u00eb aktivizonin backdoor-in p\u00ebr mjetin Automake ishin t\u00eb p\u00ebrfshira vet\u00ebm n\u00eb arhiv\u00ebn e gatshme me kodin dhe mungonin n\u00eb depozit\u00eb. <\/p>\n
Backdoor-i n\u00eb XZ u inkursionua nga nj\u00eb sulmues, i cili arriti t\u00eb merrte statusin e mb\u00ebshtet\u00ebsit n\u00eb projekt. Inkursioni i backdoor-it fillimisht nuk u v\u00ebrejt p\u00ebr shkak se distributet kryesisht nd\u00ebrtuan paketa duke shkarkuar kodin nga arhivat e gatshme, pasi gjat\u00eb shkarkimit t\u00eb kodit p\u00ebr nd\u00ebrtim mund t\u00eb mjaftohet me nj\u00eb kontroll t\u00eb vet\u00ebm p\u00ebr verifikimin e integritetit t\u00eb skedarit arkiv dhe t\u00eb p\u00ebrdoren pasqyra. V\u00ebmendja kryesore gjat\u00eb kontrollit t\u00eb kodit \u00ebsht\u00eb p\u00ebrqendruar n\u00eb analiz\u00ebn e p\u00ebrmbajtjes s\u00eb depozit\u00ebs, prandaj ndryshimet e padukshme n\u00eb arhivat nuk mund t\u00eb identifikohen gjithmon\u00eb menj\u00ebher\u00eb. <\/p>\n
To simplify the verification of compliance between archive files and the cuts from the repository corresponding to releases, some open projects, such as PostgreSQL, have introduced a system of repeatable archive generation. In this case, a toolkit is provided that allows you to independently assemble your archive from the code, fully corresponding to the ready-made archive available for download. If the independently created archive and the archive provided by the main project differ \u2014 it indicates a compromise of the repository or the reference archive. <\/p>\n
Problemi \u00ebsht\u00eb se nj\u00eb metod\u00eb e till\u00eb praktikohet vet\u00ebm n\u00eb raste t\u00eb caktuara, nd\u00ebrsa shum\u00eb projekte vazhdojn\u00eb t\u00eb p\u00ebrfshijn\u00eb n\u00eb arhivat e tyre artefakte shtes\u00eb q\u00eb mungojn\u00eb n\u00eb depozit\u00ebn kryesore, si\u00e7 jan\u00eb faqet e man, dokumentacioni, shembujt, skriptat p\u00ebr krijimin e paketeve p\u00ebr distributet dhe skedar\u00ebt e tjer\u00eb t\u00eb nd\u00ebrtimit. N\u00eb p\u00ebrgjith\u00ebsi, kjo ndodh p\u00ebr shkak t\u00eb arsyeve historike dhe karakteristikave t\u00eb proceseve t\u00eb formimit t\u00eb versioneve. Nj\u00eb verifikim i thjesht\u00eb i p\u00ebrputhjes midis p\u00ebrmbajtjes s\u00eb depozit\u00ebs dhe arhiv\u00ebs nuk \u00ebsht\u00eb i p\u00ebrshtatsh\u00ebm n\u00eb k\u00ebt\u00eb rast. <\/p>\n
As a solution, it has been proposed to collect the release binary files both from the repository (for example, you can use the automatically generated GitHub archive for the release tag) and from the archive prepared by the maintainer, subsequently comparing the results. As an experiment, the inclusion of such verification has been proposed only for the package 'xz' for now. If the experiment proves successful, the checks plan to be used in other packages in nixpkgs. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"