I want to use a recent package from a PPA. How do I make sure that the PPA maintainer hasn't added any malicious code in the version provided there?
2 Answers
- Install the
devscripts
package. - Go to the PPA page and find the source package files associated with the package that you're interested in. Find the one that ends
.dsc
. - Run the command
dget url_of_dsc_file
. This will download and unpack the source code used to build the package into a directory. Rename this directory toppa
. - Get the original source code to compare the PPA against. This could be the original upstream tarball from the project website that corresponds to the version you're using, or perhaps the most recent official Ubuntu release of the package (you can find a link to the latter
.dsc
fromhttps://launchpad.net/ubuntu/+source/source_package_name
). Download and unpack this, then rename this directory toupstream
, usingdget
to download from a.dsc
if needed. - Now compare the
upstream
andppa
directories to see if any malicious changes have been introduced inppa
that were not present inupstream
. You could use meld for this, which is a graphical diff viewer.apt-get install meld
, then runmeld upstream ppa
. It will show you which files are new, changed or removed, and you can double-click on a file to see detailed changes in an easy-to-review format.
Since PPAs are built from source on Canonical's infrastructure, you can trust that the binary you have installed from the PPA matches the source that you review as above, provided that you trust Canonical. This should be acceptable given that you trust Canonical to build Ubuntu in the first place.
-
I thought the additional patches aren't applied before running the
dh-make
hook. I believe you'll have to apply them usingquilt
, right? Correct me if I'm wrong. Couldn't find a good example. Still +1 for thedget
approach - that is the way. Jan 25, 2013 at 14:49 -
1
dget
usesdpkg-source
which will apply quilt patches after unpacking. But even if it didn't, and for older patch systems, you'd still see malicious changes indebian/patches
or equivalent. I did assume that the observer has the skill and experience to differentiate between innocuous and malicious changes, and this requirement remains regardless. Jan 25, 2013 at 15:07
You really can't be sure there is no malware in the package provided by the PPA, but you can at least check that the source code hasn't been tampered with:
- From the PPA page, download the package's
orig.tar.*
file and unpack it - then download and unpack the same version of the program from the project's website
- Run
diff -r orig-dir/ ppa-dir/
The two source trees should be identical. If they aren't, you can go through the differences in detail and make sure they're not malicious.
You also need to check the packaging itself. Debian packages can contain patches to the source tree, and they may add additional code.
Debian packages (.deb) can be unpacked like so:
ar p mypackage.deb data.tar.gz | tar zx
-
3It is easier/faster to verify the md5sum of the .orig.tar against what upstream published. Also the command you listed is a low level hack to unpack a binary package, not source. For that,
dpkg -x
is easier, but we're talking about source packages anyhow.– psusiJan 25, 2013 at 16:05