4

I want to use a recent package from a PPA. How do I make sure that the PPA maintainer hasn't added any malicious code in the version provided there?

2 Answers 2

10
  1. Install the devscripts package.
  2. Go to the PPA page and find the source package files associated with the package that you're interested in. Find the one that ends .dsc.
  3. Run the command dget url_of_dsc_file. This will download and unpack the source code used to build the package into a directory. Rename this directory to ppa.
  4. Get the original source code to compare the PPA against. This could be the original upstream tarball from the project website that corresponds to the version you're using, or perhaps the most recent official Ubuntu release of the package (you can find a link to the latter .dsc from https://launchpad.net/ubuntu/+source/source_package_name). Download and unpack this, then rename this directory to upstream, using dget to download from a .dsc if needed.
  5. Now compare the upstream and ppa directories to see if any malicious changes have been introduced in ppa that were not present in upstream. You could use meld for this, which is a graphical diff viewer. apt-get install meld, then run meld upstream ppa. It will show you which files are new, changed or removed, and you can double-click on a file to see detailed changes in an easy-to-review format.

Since PPAs are built from source on Canonical's infrastructure, you can trust that the binary you have installed from the PPA matches the source that you review as above, provided that you trust Canonical. This should be acceptable given that you trust Canonical to build Ubuntu in the first place.

2
  • I thought the additional patches aren't applied before running the dh-make hook. I believe you'll have to apply them using quilt, right? Correct me if I'm wrong. Couldn't find a good example. Still +1 for the dget approach - that is the way.
    – gertvdijk
    Jan 25, 2013 at 14:49
  • 1
    dget uses dpkg-source which will apply quilt patches after unpacking. But even if it didn't, and for older patch systems, you'd still see malicious changes in debian/patches or equivalent. I did assume that the observer has the skill and experience to differentiate between innocuous and malicious changes, and this requirement remains regardless. Jan 25, 2013 at 15:07
0

You really can't be sure there is no malware in the package provided by the PPA, but you can at least check that the source code hasn't been tampered with:

  • From the PPA page, download the package's orig.tar.* file and unpack it
  • then download and unpack the same version of the program from the project's website
  • Run diff -r orig-dir/ ppa-dir/

The two source trees should be identical. If they aren't, you can go through the differences in detail and make sure they're not malicious.

You also need to check the packaging itself. Debian packages can contain patches to the source tree, and they may add additional code.

Debian packages (.deb) can be unpacked like so:

ar p mypackage.deb data.tar.gz | tar zx
1
  • 3
    It is easier/faster to verify the md5sum of the .orig.tar against what upstream published. Also the command you listed is a low level hack to unpack a binary package, not source. For that, dpkg -x is easier, but we're talking about source packages anyhow.
    – psusi
    Jan 25, 2013 at 16:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .