The xz attack shell script

Re:The xz attack shell script by jonhohle on Tuesday April 02, 2024 @09:06PM (#39912591)

The issue was that built artifacts weren’t immutable during the test phase and/or the test phase wasn’t sandboxed from the built artifacts.

The last build system I worked on separated build and test as separate stages. That meant you got a lot of useless artifacts pushed to a development namespace on the distribution server, but it also meant later stages only needed read access to that server.

[ Parent | on HN ]

Re:The xz attack shell script by edflsafoiewq on Tuesday April 02, 2024 @10:05PM (#39912890)

The malicious .o is extracted from data in binary test files, but the backdoor is inserted entirely in the build phase. Running any test phase is not necessary.

[ Parent | on HN ]

Re:The xz attack shell script by rafaelmn on Wednesday April 03, 2024 @10:23AM (#39917917)

So if you ran build without test files it would fail. I get that this is hindsight thinking - but maybe removing all non essential files when packaging/building libraries reduces the surface area.

[ Parent | on HN ]