{"id":139662,"date":"2025-07-22T11:11:56","date_gmt":"2025-07-22T09:11:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/google-predstavil-proekt-oss-rebuild-dlya-vyyavleniya-skrytyh-izmenenij-v-paketah"},"modified":"2025-07-22T11:11:56","modified_gmt":"2025-07-22T09:11:56","slug":"google-predstavil-proekt-oss-rebuild-dlya-vyyavleniya-skrytyh-izmenenij-v-paketah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/google-predstavil-proekt-oss-rebuild-dlya-vyyavleniya-skrytyh-izmenenij-v-paketah","title":{"rendered":"Google prezantoi projektin OSS Rebuild p\u00ebr zbulimin e ndryshimeve t\u00eb fshehura n\u00eb paketa","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Kompania Google prezantoi projektin OSS Rebuild, i destinuar p\u00ebr identifikimin e ndryshimeve t\u00eb fshehta n\u00eb paketat e gatshme, t\u00eb publikuara n\u00eb repozitat. Puna e OSS Rebuild \u00ebsht\u00eb e bazuar n\u00eb konceptin e nd\u00ebrtimeve t\u00eb riprodukueshme dhe p\u00ebrqendrohet n\u00eb verifikimin e p\u00ebrputhshm\u00ebris\u00eb s\u00eb paket\u00ebs t\u00eb publikuar n\u00eb repo me paket\u00ebn e marr\u00eb nga rind\u00ebrtimi i kodit burimor referues, q\u00eb i p\u00ebrshtatet versionit t\u00eb deklaruar t\u00eb paket\u00ebs. Kodi i mjetit \u00ebsht\u00eb shkruar n\u00eb gjuh\u00ebn Go dhe shp\u00ebrndahet n\u00ebn licenc\u00ebn Apache 2.0. <\/p>\n
Aktualisht, OSS Rebuild implementon mb\u00ebshtetje p\u00ebr verifikimin e pakove nga depozitat NPM (JavaScript\/TypeScript), PyPI (Python) dhe Crates.io (Rust). N\u00eb t\u00eb ardhmen, \u00ebsht\u00eb planifikuar t\u00eb zgjerohet numri i depozitave t\u00eb mb\u00ebshtetura. N\u00eb praktik\u00eb, ky mjet lejon identifikimin e varianteve t\u00eb sulmeve t\u00eb klas\u00ebs 'supply chain', n\u00eb t\u00eb cilat, pas kompromitimit t\u00eb llogarive t\u00eb zhvilluesve ose diversioneve brenda projektit, publikohet nj\u00eb p\u00ebrdit\u00ebsim t\u00eb keq n\u00eb depo. N\u00eb k\u00ebt\u00eb rast, kodi n\u00eb depozit\u00ebn origjinale t\u00eb projektit mbetet i sakt\u00eb, nd\u00ebrsa ndryshimet e d\u00ebmshme futen vet\u00ebm n\u00eb paketat e gatshme. <\/p>\n
Sistemi, sa m\u00eb shum\u00eb t\u00eb jet\u00eb e mundur, formon automatikisht nj\u00eb skenar p\u00ebr nd\u00ebrtim t\u00eb riprodukuesh\u00ebm t\u00eb paket\u00ebs s\u00eb zgjedhur, duke p\u00ebrdorur heuristika dhe p\u00ebrshtat\u00eb parametra q\u00eb lejojn\u00eb arritjen e identitetit t\u00eb artefakteve t\u00eb ofruara n\u00eb paket\u00eb. N\u00ebse nuk \u00ebsht\u00eb e mundur t\u00eb riprodhohet automatikisht paketa e vendosur n\u00eb repo, \u00ebsht\u00eb e mundur t\u00eb shtohet manualisht specifikimi i nd\u00ebrtimit. Pasi t\u00eb ket\u00eb arritur t\u00eb riprodhoj\u00eb paket\u00ebn, mjeti OSS Rebuild ruan p\u00ebrshkrimin e procesit t\u00eb nd\u00ebrtimit p\u00ebr kontrollin e versioneve t\u00eb reja t\u00eb paket\u00ebs. P\u00ebrve\u00e7 k\u00ebsaj, publikohet informacion p\u00ebr verifikim duke p\u00ebrdorur korniz\u00ebn SLSA. <\/p>\n
Pas kryerjes s\u00eb verifikimit t\u00eb nj\u00eb versioni t\u00eb caktuar t\u00eb paket\u00ebs, formohen t\u00eb dh\u00ebnat e akreditimit, t\u00eb cilat mund t\u00eb p\u00ebrdoren nga t\u00eb tjer\u00ebt p\u00ebr vler\u00ebsimin e paketave tashm\u00eb t\u00eb verifikuara. Verifikimi mund t\u00eb kryhet p\u00ebrmes ekzekutimit t\u00eb utilitarit t\u00eb komandave ose krahasimin e hash-it t\u00eb ruajtur n\u00eb nj\u00eb ruajtje t\u00eb ve\u00e7ant\u00eb n\u00eb re. Infrastruktura p\u00ebr verifikimin e paketave mund t\u00eb vendoset n\u00eb m\u00ebnyr\u00eb t\u00eb pavarur serveri<\/a>. Gjithashtu, \u00ebsht\u00eb e mundur t\u00eb shfryt\u00ebzohet informacioni mbi verifikimet e kryera nga Google p\u00ebr disa mij\u00ebra paketa. <\/p>\n