25

Like 99% of users, I install Ubuntu from ready-made binaries.

How can I verify myself that those binaries are in fact from the original source code from Ubuntu?

It would be good to verify that NSA/someone has not collaborated with either Ubuntu or Linode (my VPS provider) to mess with the binaries. If we could verify the binaries, they would also be unlikely to attempt this in the first place as it would be easy to call them out on it.

Improve this question
6
  • You could take a look at the source code, using apt-get source, or use that to compile your own. See this question: askubuntu.com/questions/28372/…
    – Wilf
    Jul 9, 2014 at 11:45
  • 4
    Possibly useful: How to verify that package-installed files match originals? (Debian, but should be close enough to be applicable to Ubuntu)
    – user
    Jul 9, 2014 at 13:48
  • @MichaelKjörling I was looking for our version of that question...
    – Braiam
    Jul 9, 2014 at 13:52
  • 1
    @Braiam I think in this particular case Debian/Ubuntu doesn't make much of a difference. What does make a difference is the aim of the questions; the one linked above aims primarily to detect corrupted files at some point after installation, whereas this one seems to aim to detect maliciously replaced or altered files, or binary files not matching the purported source code. Different problems, which is why I tagged the link only "possibly useful".
    – user
    Jul 9, 2014 at 13:54
  • 3
    Interestingly, I think even Gentoo completely avoids this issue: there, you have to trust the source code archives downloaded. Use cryptographic signatures all you want; if you can't trust that what's signed is genuine and that it is what it is purported to be, there's little to nothing really to be done.
    – user
    Jul 9, 2014 at 13:56

6 Answers 6

Reset to default
36

You can download the sourcecode and compile it yourself. But wait - first you have to check that sourcecode, because if Canonical collaborated with the NSA, they probably have entered some code somewhere to allow for a keylogger or something that can be activated remotely.

So...

  1. after downloading the sourcecode,
  2. you have to check all code,
  3. and then compile it!

But wait - can you trust the compiler?

Improve this answer
5
  • 15
    "Can you trust the compiler?" That's when you go off on a tangent and read the question How to compile the C compiler from scratch, then compile Unix/Linux from scratch (and associated answers).
    – user
    Jul 9, 2014 at 13:50
  • 17
    But can you trust your hardware? Perhaps you should also build your computer from scratch, and that's where you run into a few issues...
    – Thomas
    Jul 10, 2014 at 0:47
  • And can you trust the hypervisor that is running your VM?
    – Fernando Correia
    Jul 10, 2014 at 16:47
  • 1
    I don't suppose there could be any use in compiling the source on a few similar compilers from different authors and checking the output for differences. But how do you know the authors aren't really the same entity under aliases? Or more likely, what if all those compilers have a common corrupt ancestor? And none of that would help the hardware trust issues anyway.
    – Keen
    Jul 10, 2014 at 16:48
  • 6
    But wait - can you trust that askubuntu isn't being filtered or completely controlled by the NSA to avoid telling you all of the potentially compromised areas?
    – TheZ
    Jul 10, 2014 at 17:02
9

If you're not willing to accept "because Ubuntu says so", then you can't.

Improve this answer
2
  • 2
    I'd add that you can [try to] verify if the binaries on your particular system match the Ubuntu-original binaries by comparing checksums. Of course, a proper rootkit wouldn't be easily detectable from within the system in any case.
    – Peteris
    Jul 9, 2014 at 15:28
  • 2
    That only works if you trust that the "original Ubuntu binaries" were not tampered with. In other words, if you accept that they are good because Ubuntu says so. ;)
    – fkraiem
    Jul 9, 2014 at 15:32
5

Ubuntu offers convenient means to compile a package on your own machine. However, there is no way to check that the executable in a binary package that you downloaded has been obtained from that source code. The signing process used by Ubuntu reduces the risk of third-party tampering with the packages substantially, but you still have to trust that no harmful code has been added before the compilation that is not reflected in the downloadable source code.

The reason is that it is tremendously hard to obtain precisely the same binaries as there are in the compiled packages, as these depend on the precise compiler version, its options, and probably there are also some paths or environment variables compiled into the binary. So you will be unable to obtain precisely the same binary when compiling yourself, which would "verify" the downloaded binary.

There is actually a small research community around precisely this problem - how to make compilation reproducible.

Having said that, a manual comparison of a downloaded binary and a self-compiled one can detect added/modified code, so it would be risky for someone offering binaries and the source code to hide something in the binaries, as this can be detected.

But then there is also the problem of trusting the compiler, as already mentioned...

Improve this answer
4

It is a difficult problem to create the exact same binaries on two different machines. The TOR project does this as regular part of their build. There is a description how they do it. Debian and Fedora seem to have projects making this possible for this distributions, but they are in the early stages. It doesn't seem like there is any work done in Ubuntu.

To reproduce a Ubuntu binary Package you would need to reproduce the environment it was created in as closely as possible. To start with that, you first need to find out where and how this packages where compiled. It doesn't look like that information is easy to find.

Improve this answer
2
  • Details on what specific?
    – Josef
    Jul 9, 2014 at 18:22
  • Ignore me, confused with a different post :)
    – Tim
    Jul 9, 2014 at 18:25
0

Checking with Ubuntu's MD5. If the MD5 you get from your files matches the one published by Ubuntu then no one has tampered with the binaries inbetween.

Improve this answer
3
  • This is not OP's question. He's worried about the source code being distributed by Ubuntu not being the same as the binaries being distributed by Ubuntu. In other words, they say "this is the source," but the source they are building the binaries from actually has some extra NSA-introduced code. He's not worried that the binaries have been tampered with after build.
    – John Chrysostom
    Jul 10, 2014 at 19:06
  • The OP posted: "How can I verify myself that those binaries are in fact from the original source code from Ubuntu?" The answer is for that question. The other one is ridiculous, who can know if the Linux kernel has not been tampered by anyone (NSA or who ever?) easy, download the code, read it and once you are happy compile it yourself. Other than that, my answer is for the question I have copied in the begining of this comment.
    – YoMismo
    Jul 14, 2014 at 6:31
  • You have not answered the question you quoted. Using the MD5 only lets him verify that the binaries on his computer match the binaries on the server. They DO NOT let him verify that the binaries he downloaded were compiled from the source Ubuntu provides. Now, I agree that his questions is ridiculous for the reason you (and others) have stated. But that WAS his question.
    – John Chrysostom
    Jul 14, 2014 at 11:56
0

That is a Hard job , I think trust here is better than this complicated job. But the question Can you trust ?

Because Open source software gives many freedoms for users to change in the code , you cant trust anyone .

Lets make a scenario for this purpose , i wanna check that my Ubuntu == source code , wait Why you don't try to compare packages to their source ?

  1. Build a binary package for Ubuntu from source .
  2. compared the self-built binary package with the one published by the distribution.
  3. Use apt-get -b source to download the source .

But for me comparing well give you minor different results due to different timestamps , environments , but does that prove that its not from the source code !

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.