Webtagr - Technology News Summarizer

Popular：

Virtualization DNS security formal verification reachability analysis compiler errors macro conflict web extension development framework Bitmap Graphics API inconsistencies All Tags

Open Source Supply Chain Attack: The xz Backdoor Incident

2025-03-22

In March 2024, a backdoor was discovered in xz, a widely used compression software. A malicious maintainer, using the pseudonym Jia Tan, secretly inserted this backdoor over three years. The backdoor enabled remote code execution on machines with ssh installed. Its discovery was accidental, by a Postgres developer investigating unrelated performance issues. This article details the backdoor's mechanics and proposes using build reproducibility for detection. The backdoor involved modifying the xz build process to inject a malicious object file and leveraging glibc's ifunc mechanism to hook ssh's RSA_public_decrypt function. The author advocates building software from trusted sources and leveraging build reproducibility to enhance software supply chain security, such as comparing GitHub releases with maintainer-provided tarballs and checking binary consistency across build sources.

NixOS Build Reproducibility: Better Than You Think

2025-02-12

NixOS's build reproducibility has long been a point of contention. While its functional package manager model contributes to build reproducibility, it doesn't guarantee bitwise reproducibility for all builds. A new research paper empirically studies Nixpkgs (NixOS's package collection) over six years, revealing a steadily increasing reproducibility rate—from 69% in 2017 to 91% in April 2023. The study also identifies prevalent causes of non-reproducibility, such as embedded dates, uname outputs, environment variables, and build IDs. These findings demonstrate that while Nixpkgs already achieves high reproducibility rates, there's room for improvement by addressing these low-hanging fruits. This research is crucial for increasing trust in the Nix substitution protocol and driving the development of distributed caching solutions based on build reproducibility.