How safe are you and how much do you trust your distro?

Except for a few distros that assist their users to build everything they install from source (kiss and forks, LFS and forks, gentoo and forks, crux, exherbo, T2-sde, etc), most linux-distributions, offer binaries to be installed, usually backed up by the source code (script) building the package from either their own source code, or what we call upstream (other FOSS sources).  How do you know though, that what the source repository shows and what the binary package contains is the same?  One way is to build it with the same recipe (packaging source script) and compare the sums.  Very few people do this and in very rare and controlled environments is the product the same, meaning checksums are identical (Arch is reporting 15-20% failure to reproduce their own packages).  So what most distros do is they sign their packages and by having their public signature key, you know what they built is what you got.  But are you sure they built it right, or did they take adequate measures to make sure what they pulled from upstream to build the package is what the author really published?  How can you check?

There are two general methods packagers make sure what they use is what the author released.  One is using git to draw the source which contains various tools in making sure the author’s repository of source and what you cloned is the same.  The other way is a tarball of the source repository, signed by the author with a GnuPG key, known as a gpg key, and you check the tarball (a compressed archive xxxx.tar.xzz  yyyy.tar.bz2  zzz.tar.gz .. etc accompanied with a same name .asc or .sig file containing the signature).  It is virtually impossible as far as we know that a “man in the middle” will be able to switch the tarball on you “live”, and be able to counterfeit the signature so your altered code is signed by the correct author as well.  But “man-in-the-middle” MIM attacks are not as rare as you think, even though it takes tremendous infrastructure to make one and get away with it.  For people though who may be targeted by such infrastructure it is not unlikely, it is expected (highly likely).  How do you know you may be targeted?  I think you know, we know, that you know, why you are targeted by you know whom.

So if the packaging script uses git to clone the code, or uses a signed tarball, and the builder is setup to only proceed if the signatures match, then you know between the external source and the builder, things seem safe.  Things are better for reproducibility sakes if the sums of the tarballs and any patch and configuration files are contained in the packaging script.  AND, the builder will refuse to build a package if what is in the source as input has different checksums than what is fed to the builder.  This means that at any given moment, you copy the packaging script containing all those checksums, you build the same package yourself, and the contents should be identical.  Is this so much to ask?

If the builder signs themselves the packages made, and your binaries are signed, this is good.  That means your package manager will check the distro’s signatures (usually called a keyring if there are more than one developers doing packaging) before it installs a package.

Now all those checks and verifications to some seem redundant and an overkill.  Such people may say “I” don’t think anyone is targeting me, so this is not likely it will happen to me, but they are producing packages for “you”.  They may also say, due to their own bias and ignorance, that MIM attacks are very rare and do not happen, but are only theoretically possible.  So “THEY” decide this is unnecessary and an additional complication, and let the builder build packages without checking tarballs, without failing if published checksums don’t match, and just go by due to nobody checking on them.

Then you ask, if it wasn’t so much trouble, why did they omit making those checks or have the builder stop unless everything matches?  WHY?  Stupidity is one side of the face of those who are guilty, guess what the other side may be!

“Knowledge is freedom”, and lack of knowledge is lack of freedom, and such irresponsible people build on their own ignorance and irresponsibility, and publish dangerous software for less suspecting “victims”.  It will be hard to tell whose victims they will be, whether they were really “acting” ignorant and irresponsible because they are, or are they playing this role to create more victims themselves, or provide dominant powers with more victims.  Meaning they are irresponsible people on the payroll.

I say, check on your distro, see in detail the process of building, test here and there to see if things “add up”, are the checksums published are really used, is the upstream source signed and those signing keys used in the packaging script, and then the packages signed and your package manager screening those that fail, deleting them asking for a new copy?  Free yourself, rely on nobody.

I have recently found, in tremendous disappointment, that certain distros have allowed certain packagers, to risk the safety of users, by pretending to use checksums when the builder doesn’t fail on non-matching ones, failing to check gpg keys of upstream tarballs, and getting generally away with tremendous risk to themselves, to their users, and the reputation of linux in general.  Such careless and irresponsible projects should be blacklisted and avoided for being an offense to common sense of decency.

 

Maybe if things were more organized in the linux community things would be more see-through.  Building logs would be visible, sums and gpg keys used everywhere, and those that fail to adopt all the common and known measures would be blacklisted.  There would be an organization “of users” controlling the vendors and not the vendors themselves controlling who stays afloat and who doesn’t.  It appears as between them, offenders, have a code of silence against whistle blowing.  “We just worry about what we do, we don’t speak of other distros here”.  So you are banned once by the offender, you are banned twice by the peers refusing to let you talk about the other distro.   Business is good for all businessmen!

You, a devil’s advocate, will say, if someone publishes code, signs it, you compile it, install it, and use it, how do you know to trust them?  One is that you and thousands of others can audit and review their published code, the other is reputation.  The longer an author of FOSS is known, published, and his code used, the more trustworthy they become.  With large corporations such as freedesktop, google, IBM, facebook, publishing enormous amounts of code in alarming frequency, it is virtually impossible to review their code as fast as they pump it out.  By the time you find and report a glitch (security glitch) they may have revised the code three more times.  It would take an organization 4 times as large as Brave-Browser corporation, to review the code of each edition/release of the browser, between release n and release n+1!!  Runit’s code hasn’t been touched for nearly a decade, and hundreds, if not thousands, have read every line of it, maybe twice!

It takes YEARS to build trust in code writing, it takes ONE DAY to lose it for a LONG TIME!

Moral of the story:

If you, and the people around you (depending on you and your expertise), have reasons to believe you may be targeted for whatever reason, by known famous organized attacking organizations, DO NOT USE software and distributions that take such security measures lightly and deem them extreme.  Their ignorance are a risk to your livelihood and your data’s security.  Need I spell it out?  Either get more serious with the FOSS you use, or stop playing around with “childish” projects whose security is taken as a joke.

“Knowledge is freedom“, but what would freedom be like without equality?  And when we are surrounded by deranged dictators seeking every opportunity to enforce their ego-trips on anyone they can take advantage of, we will have neither freedom nor equality.  You throw one stone and you hit three such people in the linux community.  It is unimaginable how many toxic dictators are congregated around “Free” software, and how common it is for whistle-blowers to vanish because of such dictators.

Not here people, speak UP!   We are listening and we will not provide a safe house for such fascists!

Just think, like we mentioned last year about irc, you install binaries from a specific source, your package manager hits their servers during every update, you provide your whereabouts by participating in forums, chatrooms, and lists, and your data is clearly on the hands of such schizophrenic psychopaths to take advantage of you.

NONE of those we offended with the “irc” “freenode” article, came out to say we were wrong, and ask us to take back the offensive accusation!   They went on as business as usual.  And they will continue to go on and on and on, as long as there are victims!