Tell me more ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.
up vote 4 down vote favorite
2

I want to use a recent package from a PPA. How do I make sure that the PPA maintainer hasn't added any malicious code in the version provided there?

share|improve this question

2 Answers

up vote 9 down vote accepted
  1. Install the devscripts package.
  2. Go to the PPA page and find the source package files associated with the package that you're interested in. Find the one that ends .dsc.
  3. Run the command dget url_of_dsc_file. This will download and unpack the source code used to build the package into a directory. Rename this directory to ppa.
  4. Get the original source code to compare the PPA against. This could be the original upstream tarball from the project website that corresponds to the version you're using, or perhaps the most recent official Ubuntu release of the package (you can find a link to the latter .dsc from https://launchpad.net/ubuntu/+source/source_package_name). Download and unpack this, then rename this directory to upstream, using dget to download from a .dsc if needed.
  5. Now compare the upstream and ppa directories to see if any malicious changes have been introduced in ppa that were not present in upstream. You could use meld for this, which is a graphical diff viewer. apt-get install meld, then run meld upstream ppa. It will show you which files are new, changed or removed, and you can double-click on a file to see detailed changes in an easy-to-review format.

Since PPAs are built from source on Canonical's infrastructure, you can trust that the binary you have installed from the PPA matches the source that you review as above, provided that you trust Canonical. This should be acceptable given that you trust Canonical to build Ubuntu in the first place.

share|improve this answer
I thought the additional patches aren't applied before running the dh-make hook. I believe you'll have to apply them using quilt, right? Correct me if I'm wrong. Couldn't find a good example. Still +1 for the dget approach - that is the way. – gertvdijk Jan 25 at 14:49
1  
dget uses dpkg-source which will apply quilt patches after unpacking. But even if it didn't, and for older patch systems, you'd still see malicious changes in debian/patches or equivalent. I did assume that the observer has the skill and experience to differentiate between innocuous and malicious changes, and this requirement remains regardless. – Robie Basak Jan 25 at 15:07
up vote 0 down vote

You really can't be sure there is no malware in the package provided by the PPA, but you can at least check that the source code hasn't been tampered with:

  • From the PPA page, download the package's orig.tar.* file and unpack it
  • then download and unpack the same version of the program from the project's website
  • Run diff -r orig-dir/ ppa-dir/

The two source trees should be identical. If they aren't, you can go through the differences in detail and make sure they're not malicious.

You also need to check the packaging itself. Debian packages can contain patches to the source tree, and they may add additional code.

Debian packages (.deb) can be unpacked like so:

ar p mypackage.deb data.tar.gz | tar zx
share|improve this answer
3  
It is easier/faster to verify the md5sum of the .orig.tar against what upstream published. Also the command you listed is a low level hack to unpack a binary package, not source. For that, dpkg -x is easier, but we're talking about source packages anyhow. – psusi Jan 25 at 16:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.