Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I'm sure that there must have been any number of audits on common Java open source projects, many of them for governments or publicly-funded bodies.
Have any of the results been made public, so that an average user could take a particular version of a particular JAR (with a particular checksum) and have a much higher level of confidence that it does not contain any backdoors or similar?
A code audit should only be considered a point in time audit, and should be not be considered a future guarantee. It is possible that some product has had an audit or review done by a third party and they may make that report available, but new techniques or different methods, timelines, and budgets could result in additional bugs being found later. In the end, they may not have found anything.
For legal reasons, you are unlikely to find anyone giving a guarantee, warranty, or otherwise on a code review. More useful would be a review of the development process for testing, controls, procedures, and ongoing reviews.
What you may be able to find is documentation of existing vulnerabilities and patches you can apply, reviews, discussions, etc. If you can verify the checksum/hash of a JAR obtained with the one provided form the developer this can give you some confidence. If it's a popular Open Source project, likely people would complain or post patches if a weakness or vulnerability is found. You may also gain some assurance from a signed-JAR. Would you sign something that you put a backdoor in as the original developer?
Also, very few open source licenses give any warranty and may not even guarantee any suitability. You need to take a calculated risk on the author of the code, the service providing the source or executable, and the requirements of the application. You should also have some reasonable assurance in your own environment's firewalls, AV, etc. to block or identify threats.
Lastly, most reviews are likely to be triggered from customization of open code, not from the base package.
