I have downloaded the ISO image of Kubuntu 20.10 and installed it.
I am afraid that the ISO image may have been tainted (for example, by the NSA) to insert a backdoor into it.
As I see it, there are two ways to insert a backdoor (I mean an intentional one, not an OpenSSL bug):
Directly in the source code that is published on the internet. I don't think this is feasible. I don't have the time to read all the 10M+ lines of the Linux kernel, and, even if I did, I don't nearly have the skill to understand most of it. Moreover, I would also have to check all the source code of all the libraries on top of the kernel (qt, all the apps, etc.). But I am not worried about this for the following reason: I think a lot of people and companies work on the kernel (for instance, Google with android, Red Hat with its for-profit Linux OS, etc.). It would be in their financial interest, if they spot a backdoor, to blow the whistle and then sell their own backdoor-free kernel
But, I don't know whether the binary I have downloaded results from the compilation of the source code published on the internet, or of some other source code (the idea, of course, is for the NSA to download the kernel source, add the backdoor, compile, and publish that binary). I don't mean that Canonical necessarily sold me a tainted binary. What I am telling here can be achieved in multiple ways. For example, the NSA can spoof the DNS records I use, and, when I digit ubuntu.com, they have me connect to their own website, which looks exactly like the official website, but the NSA binaries are provided instead of the correct ones.
How can I avoid the risk illustrated in number 2, and check that the ISO image I have downloaded was compiled from the source published on the web?