{"id":139662,"date":"2025-07-22T11:11:56","date_gmt":"2025-07-22T09:11:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/google-predstavil-proekt-oss-rebuild-dlya-vyyavleniya-skrytyh-izmenenij-v-paketah"},"modified":"2025-07-22T11:11:56","modified_gmt":"2025-07-22T09:11:56","slug":"google-predstavil-proekt-oss-rebuild-dlya-vyyavleniya-skrytyh-izmenenij-v-paketah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/google-predstavil-proekt-oss-rebuild-dlya-vyyavleniya-skrytyh-izmenenij-v-paketah","title":{"rendered":"Google paraqiti projektin OSS Rebuild p\u00ebr identifikimin e ndryshimeve t\u00eb fshehura n\u00eb paketa","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Kompania Google paraqiti projektin OSS Rebuild, i cili \u00ebsht\u00eb i destinuar p\u00ebr t\u00eb identifikuar ndryshimet e fshehura n\u00eb paketat e p\u00ebrgatitura, q\u00eb publikohen n\u00eb depo. Puna e OSS Rebuild baztohet n\u00eb konceptin e nd\u00ebrtimeve t\u00eb riprodhueshme dhe p\u00ebrfshin verifikimin e p\u00ebrputhshm\u00ebris\u00eb s\u00eb paket\u00ebs s\u00eb publikuar n\u00eb depo me paket\u00ebn e marr\u00eb n\u00eb baz\u00eb t\u00eb rinehjes nga kodi burimor referues, q\u00eb i korrespondon versionit t\u00eb deklaruar t\u00eb paket\u00ebs. Kodi i mjetit \u00ebsht\u00eb shkruar n\u00eb gjuh\u00ebn Go dhe shp\u00ebrndahet n\u00ebn licenc\u00ebn Apache 2.0. <\/p>\n
Aktualisht, OSS Rebuild ofron mb\u00ebshtetje p\u00ebr verifikimin e pakove nga depozit\u00eb NPM (JavaScript\/TypeScript), PyPI (Python) dhe Crates.io (Rust). N\u00eb t\u00eb ardhmen, planifikohet q\u00eb numri i depozitave t\u00eb mb\u00ebshtetura t\u00eb zgjerohet. N\u00eb praktik\u00eb, kjo mjet ofron mund\u00ebsin\u00eb p\u00ebr t\u00eb identifikuar variante t\u00eb sulmeve t\u00eb klas\u00ebs 'supply chain', ku, pas komprometimit t\u00eb llogarive t\u00eb mb\u00ebshtetjes ose divergjenc\u00ebs brenda projektit, nj\u00eb p\u00ebrdit\u00ebsim i d\u00ebmsh\u00ebm publikohet n\u00eb depo. N\u00eb k\u00ebt\u00eb rast, kodi n\u00eb depozit\u00ebn burimore t\u00eb projektit kryesor mbetet i sakt\u00eb, nd\u00ebrsa ndryshimet e d\u00ebmshme b\u00ebhen vet\u00ebm n\u00eb paketat e gatshme. <\/p>\n
Sistemi n\u00eb mas\u00eb t\u00eb mundshme formon automatikisht nj\u00eb skenar p\u00ebr nd\u00ebrtimin e riprodhuesh\u00ebm t\u00eb paket\u00ebs s\u00eb zgjedhur, duke p\u00ebrdorur heuristik\u00ebn dhe duke p\u00ebrzgjedhur parametrat q\u00eb lejojn\u00eb arritjen e identitetit t\u00eb artefakteve t\u00eb ofruara n\u00eb paket\u00eb. N\u00ebse nuk \u00ebsht\u00eb e mundur t\u00eb riprodhohet automatikisht paketa e publikuar n\u00eb depo, \u00ebsht\u00eb e mundur shtimi manual i specifikacionit t\u00eb nd\u00ebrtimit. Pasi t\u00eb arrihet riprodhimi i paket\u00ebs, mjeti OSS Rebuild ruan p\u00ebrshkrimin e procesit t\u00eb nd\u00ebrtimit p\u00ebr verifikimin e versioneve t\u00eb reja t\u00eb paket\u00ebs. P\u00ebr m\u00eb tep\u00ebr, publikohet informacion p\u00ebr verifikim duke p\u00ebrdorur korniz\u00ebn SLSA. <\/p>\n
Pas realizimit t\u00eb verifikimit t\u00eb nj\u00eb versioni t\u00eb caktuar t\u00eb paket\u00ebs, krijohen t\u00eb dh\u00ebna atestimi, t\u00eb cilat mund t\u00eb p\u00ebrdoren nga t\u00eb tjer\u00eb p\u00ebr t\u00eb vler\u00ebsuar paketat e verifikuara tashm\u00eb. Verifikimi mund t\u00eb b\u00ebhet p\u00ebrmes ekzekutimit t\u00eb mjetit t\u00eb linj\u00ebs s\u00eb komand\u00ebs ose duke p\u00ebrputhur hashin e ruajtur n\u00eb nj\u00eb depo t\u00eb ve\u00e7ant\u00eb n\u00eb cloud. Infrastruktur\u00ebn p\u00ebr verifikimin e paketimeve mund t\u00eb implementohet n\u00eb m\u00ebnyr\u00eb t\u00eb pavarur server<\/a>. Po ashtu, mund t\u00eb p\u00ebrdoret informacioni p\u00ebr verifikimet q\u00eb kryhen nga Google p\u00ebr disa mij\u00ebra paketa. <\/p>\n