0

I would like to understand how the packaged Linux distributions (i.e. Debian) ensure that their packages don't contain any malicious code. I know that packages are signed, and that I can download the package source and compile the package myself. But even when I do compile the package myself, the md5sum of that package will be different from the distribution package (even if the source code is identical). The same applies if I compile the same code twice (i.e. on two different machines), the resulting binary will be different.

Do I understand it correctly, that the whole trust lies in the maintainer who compiles (and signs) the package? What if somebody evil bribed this maintainer to smuggle in some back door. How would we detect it?

UPDATE:

I have tried compiling mc from debian source with dpkg-buildpackage, but I am unable to produce identical mc binary:

# apt-get source mc
# cd mc-4.8.3/
# dpkg-buildpackage
# cd ..
# md5sum mc_4.8.3-10_amd64.deb
f373e2a80074098e1ce1672428660dd4  mc_4.8.3-10_amd64.deb
#
# apt-get download mc
# md5sum mc_4.8.3-10_amd64.deb
9e412f6352b2b013a8e15ea88a48b21e  mc_4.8.3-10_amd64.deb
|improve this question
1

If you compile the package yourself - and use the same compiler and settings - then you will get identical binaries to the distribution binaries. The theory is that in a large community like Debian, some people will periodically do this, and would detect any changes introduced by the package maintainer. The maintainer is in a highly trusted position, and we can't really avoid that, but at least there is some oversight by the wider community.

The source code is open for public inspection, so the theory is that some people in the community will review this. Anyone with write access to the source code is again in a highly trusted position, but again, there is some community oversight.

Compare this to closed source software where there is very little oversight at all. When you pick up a Windows DVD, what confidence do you have that there is not an NSA backdoor on the disc?

|improve this answer
  • 1
    I have assumed, that compiling a package from Debian source will not produce identical Debian binary. I have tried this with mc and my assumption is confirmed. My mc binary does not even have the same size, let alone same md5sum. What do I have to do to create identical binary from Debian source? – Martin Vegter Feb 17 '14 at 21:34
  • @MartinVegter - you must use an identical build environment and process to the package maintainer. Sometimes the details of this are published as part of the package description. If not, I suggest you contact the maintainer directly. – paj28 Feb 17 '14 at 21:42
  • by "identical build environment" you mean same gcc version, or more than that? – Martin Vegter Feb 17 '14 at 22:16
  • 1
    @MartinVegter same version of all tools and libraries. Probably the base release of that version of Debian without any updates. Identical architecture - no cross compiling. dkpg-rebuildpackage should ensure identical options are used. Not something I've really done; I'd expect the first time will be quite a hassle to get right, but with experience you'll get better at it. – paj28 Feb 17 '14 at 23:00
  • I do not think one can realistically produce an identical checksum, the two systems are usually too different. It requires overhauling your system, and doing that for each package you're checking is simply a mess. Is there a better way? – Hello World Oct 21 '14 at 17:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.