Given that I have an "acceptable" source code of some program (Tor was mentioned in a previous version of this question), where "acceptable" means that I trust this source code and want to use it for my needs; is there a possibility, that if I use pre-complied binaries (someone else's compilation), that I will get an "unacceptable" binary that contains different code than the "acceptable" source code I saw (e.g. backdoored binary)?
The answer is, of course, that it's possible. There are four major ways that can happen.
1) The binaries you downloaded include a vulnerability and weren't built with the signed source code.
- Answer: Perform your own deterministic build based on the instructions provided at blog.torproject.org, which states "We achieve our build security through a reproducible build process that enables anyone to produce byte-for-byte identical binaries to the ones we release. Elsewhere on the Internet, this process is varyingly called "deterministic builds", "reproducible builds", "idempotent builds", and probably a few other terms, too."
2) The compiler you used included a vulnerability in your binaries, perhaps a specific implementation of the Ken Thompson hack from 1984
- Partial Answer: This one's harder, though using different compilers from different sources and then doing careful analysis on the results to see if they have the same behaviors would be reasonable, if time-consuming.
3) Your OS or drivers are compromised.
- That's outside of the scope of this answer.
4) Your CPU and/or NIC is compromised.
- That's also outside the scope of this answer.
Nowadays compilers will generate different binary each time:
- BuildID will be different
- compiling time (present in some types of binaries) will be different
So don't ever expect getting identical files from identical code.
Apart from this, TOR is a very specific software, that is pain-in-the-ass for many governments, 3-letter agencies and everyone responsible for deffensive security. So expect, that there are many people with a vital interest to add some backdoor to it.
There is no straight 100% sure answer, if TOR binaries are backdoored. It's a matter of trust to its publishers:
if you're trying to hide some minor activities, you can trust them (in general), as it would too much noise if someone would really use such backdoor to raid existing TOR users doing minor activities
if you're trying to avoid live in prison for some really serious activities like Silk Road X.0, then trust no one