I would like to understand how the packaged Linux distributions (i.e. Debian) ensure that their packages don't contain any malicious code. I know that packages are signed, and that I can download the package source and compile the package myself. But even when I do compile the package myself, the md5sum of that package will be different from the distribution package (even if the source code is identical). The same applies if I compile the same code twice (i.e. on two different machines), the resulting binary will be different.
Do I understand it correctly, that the whole trust lies in the maintainer who compiles (and signs) the package? What if somebody evil bribed this maintainer to smuggle in some back door. How would we detect it?
UPDATE:
I have tried compiling mc
from debian source with dpkg-buildpackage
, but I am unable to produce identical mc
binary:
# apt-get source mc
# cd mc-4.8.3/
# dpkg-buildpackage
# cd ..
# md5sum mc_4.8.3-10_amd64.deb
f373e2a80074098e1ce1672428660dd4 mc_4.8.3-10_amd64.deb
#
# apt-get download mc
# md5sum mc_4.8.3-10_amd64.deb
9e412f6352b2b013a8e15ea88a48b21e mc_4.8.3-10_amd64.deb