You're looking for what's called reproducible builds.
this post was submitted on 01 Sep 2023
50 points (100.0% liked)
Open Source
31066 readers
465 users here now
All about open source! Feel free to ask questions, and share news, and interesting stuff!
Useful Links
- Open Source Initiative
- Free Software Foundation
- Electronic Frontier Foundation
- Software Freedom Conservancy
- It's FOSS
- Android FOSS Apps Megathread
Rules
- Posts must be relevant to the open source ideology
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
- !libre_culture@lemmy.ml
- !libre_software@lemmy.ml
- !libre_hardware@lemmy.ml
- !linux@lemmy.ml
- !technology@lemmy.ml
Community icon from opensource.org, but we are not affiliated with them.
founded 5 years ago
MODERATORS
F Droid is as close as you're going to get. They take open source projects and build them independently and then publish. So if you trust f Droid, then the code you get from f Droid is the right code, and the binary you get from Android is the right binary.
Fdroid is great but OPs question is even more important then, installing an installer app without knowing its legitimacy could lead to many apps being infected.
Sure, its about who you trust in this scenario. once you introduce a compiler it becomes unprovable. So what your threat model is, and who you can trust.
Someone already mentioned reproducible builds. Other alternative is to build it from source yourself.
As the article/SO answer posted by cwagner tells you you effectively can't, because a "trojan" could be injected at many different levels and even self-compiling the source code depends on some compiler binary that you have to get from somewhere (build your own compiler, you tell me, but what do you use to compile THAT?).
In practice for most people the correct answer is "get the binary from your distributions normal repository". By using a given distribution you already implicitly trust that distribution (because if you don't, why use it?), so non-core software from their repository should also be considered trustworthy (at least in the sense that no additional trojans were introduced that aren't in the source).
That doesn't really help with Windows, though. There your best bet is to get a binary that's from as close to the original authors themselves. Ideally from their project home page themselves.
You might find The Full-Source Bootstrap: Building from source all the way down by some of the GNU Guix maintainers of interest to read, which discusses how Guix is attempting to solve the "trusting trust" attack some have mentioned here.
Although I haven't used it myself yet, Guix actually has a feature that lets you "challenge" the build servers to see if your builds match the pre-built binaries (the command being aptly named guix challenge).
Do you use Guix? I've found it quite interesting and I'd love to try it out one day. The thing is, I need the mainline Linux kernel for some proprietary drivers.
I do!
For starters, you're not required to install Guix System in order to use the Guix package manager itself; the manual provides instructions for installing it on top of your existing system here if you want to use it but not fully commit (you can do this with Nix too).
Guix allows for adding new sources to pull packages from using channels. The nonguix channel provides the Linux kernel - blobs and all - as well as other stuff that won't be upstreamed, like Steam and NVIDIA drivers.
I recommend this helpful series by System Crafters, which includes a few guides on installing Guix and Guix System with the full Linux kernel.
Thank you. I currently use NixOS, but Guix always seemed interesting.
Of course, you simply have to be the one to compile it :p
Decompile it and verify