Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

The Chromium Stable PPA (as found here: ppa:chromium-daily/stable) is maintained by Chromium Team (https://launchpad.net/~chromium-team). I assume this is "Google's" Chromium developers? If so, I would assume this PPA is very safe and trustworthy.

But is there a specific procedure or method of investigation that I should/can do to confirm the identity of the maintainer? As I understand it (or at least have read), anyone can create a "Chromium Team" PPA. For safety and security, I'd like to learn how to confirm the identity of PPA maintainers, especially "big name" maintainers like Google or Mozilla.

share|improve this question
add comment

1 Answer

The "Chromium Team" in Launchpad are Ubuntu developers, not Google developers (except for one, who works on Chromium at Google). You can see this by looking at the team's membership:

The way you would determine if upstream maintainers are active in a team is to see if you recognize names (or email addresses). For the large projects like Mozilla and Chrome where Ubuntu developers work with their respective upstream generally speaking I trust them.

For example the team that runs the Firefox PPA is the same team that maintains Firefox in the distribution, and the team that maintains the Chromium PPA is also the same team that maintains Chromium in the distro.

There's really no way to determine how "trustworthy" a PPA is on a glace (Which is why most people will usually recommend not trusting them by default). Currently there is no real way for you to know just how "official" a PPA is unless it's explicitly mentioned by an upstream as trustworthy (see how XBMC recommends a PPA in that link) or you recognize the people in a team. In Open Source since everything is done in the open trust is something that is earned by people based on behavior. For example I trust someone who works at Mozilla to write my browser and I trust someone who is an Ubuntu developer to package it properly since both organizations have a model of peer review.

Individual PPAs are another matter, there's no guarantee that they won't break anything, but that doesn't mean every one is automatically bad. Chris talks about this a bit about PPA security in this answer:

share|improve this answer
    
So essentially, unless I know names that appear in the "Members" to be trustworthy, I can never be sure the PPA is safe? Jorge, what's the difference between the Chromium PPA and the Universe repo of Chromium? I'm assuming the Universe repo of Chromium is also maintained by Ubuntu developers? –  Sam Jul 15 '11 at 15:18
    
So essentially, unless I know names that appear in the "Members" to be trustworthy, I can never be sure the PPA is safe — true, but the same applies to all software installed from the Internet. You don't know that every name on the Ubuntu maintainers list is trustworthy either. –  OrbWeaver Jul 15 '11 at 15:52
    
@Sam I've updated my answer, Feel free to ask about the differences between Chromium from the PPA and universe as a new question. –  Jorge Castro Jul 15 '11 at 16:45
    
@Sam: I belive your question was not answered appropriately, so i'll take a crack. In general if you know the packaging group and already trust them, then that is quickest. I also want to mention, YMAK we in the community do things the 'Free' way... or at least the 'Open' way... You always have the option of reviewing the code yourself. Launchpad requires all sources to be uploaded signed, which it then verifies from a previously provided gpg key. So you can be sure the source package originally created, is the same package you download. –  TechZilla May 23 '12 at 18:56
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.