# How can I confirm that the binaries in my Ubuntu are from the source code it should be from?

How can I verify myself that those binaries are in fact from the original source code from Ubuntu?

It would be good to verify that NSA/someone has not collaborated with either Ubuntu or Linode (my VPS provider) to mess with the binaries. If we could verify the binaries, they would also be unlikely to attempt this in the first place as it would be easy to call them out on it.

• You could take a look at the source code, using apt-get source, or use that to compile your own. See this question: askubuntu.com/questions/28372/… – Wilf Jul 9 '14 at 11:45
• Possibly useful: How to verify that package-installed files match originals? (Debian, but should be close enough to be applicable to Ubuntu) – a CVn Jul 9 '14 at 13:48
• @MichaelKjörling I was looking for our version of that question... – Braiam Jul 9 '14 at 13:52
• @Braiam I think in this particular case Debian/Ubuntu doesn't make much of a difference. What does make a difference is the aim of the questions; the one linked above aims primarily to detect corrupted files at some point after installation, whereas this one seems to aim to detect maliciously replaced or altered files, or binary files not matching the purported source code. Different problems, which is why I tagged the link only "possibly useful". – a CVn Jul 9 '14 at 13:54
• Interestingly, I think even Gentoo completely avoids this issue: there, you have to trust the source code archives downloaded. Use cryptographic signatures all you want; if you can't trust that what's signed is genuine and that it is what it is purported to be, there's little to nothing really to be done. – a CVn Jul 9 '14 at 13:56

You can download the sourcecode and compile it yourself. But wait - first you have to check that sourcecode, because if Canonical collaborated with the NSA, they probably have entered some code somewhere to allow for a keylogger or something that can be activated remotely.

So...

2. you have to check all code,
3. and then compile it!

But wait - can you trust the compiler?

• "Can you trust the compiler?" That's when you go off on a tangent and read the question How to compile the C compiler from scratch, then compile Unix/Linux from scratch (and associated answers). – a CVn Jul 9 '14 at 13:50
• But can you trust your hardware? Perhaps you should also build your computer from scratch, and that's where you run into a few issues... – Thomas Jul 10 '14 at 0:47
• And can you trust the hypervisor that is running your VM? – Fernando Correia Jul 10 '14 at 16:47
• I don't suppose there could be any use in compiling the source on a few similar compilers from different authors and checking the output for differences. But how do you know the authors aren't really the same entity under aliases? Or more likely, what if all those compilers have a common corrupt ancestor? And none of that would help the hardware trust issues anyway. – Keen Jul 10 '14 at 16:48
• But wait - can you trust that askubuntu isn't being filtered or completely controlled by the NSA to avoid telling you all of the potentially compromised areas? – TheZ Jul 10 '14 at 17:02

If you're not willing to accept "because Ubuntu says so", then you can't.

• I'd add that you can [try to] verify if the binaries on your particular system match the Ubuntu-original binaries by comparing checksums. Of course, a proper rootkit wouldn't be easily detectable from within the system in any case. – Peteris Jul 9 '14 at 15:28
• That only works if you trust that the "original Ubuntu binaries" were not tampered with. In other words, if you accept that they are good because Ubuntu says so. ;) – fkraiem Jul 9 '14 at 15:32

Ubuntu offers convenient means to compile a package on your own machine. However, there is no way to check that the executable in a binary package that you downloaded has been obtained from that source code. The signing process used by Ubuntu reduces the risk of third-party tampering with the packages substantially, but you still have to trust that no harmful code has been added before the compilation that is not reflected in the downloadable source code.

The reason is that it is tremendously hard to obtain precisely the same binaries as there are in the compiled packages, as these depend on the precise compiler version, its options, and probably there are also some paths or environment variables compiled into the binary. So you will be unable to obtain precisely the same binary when compiling yourself, which would "verify" the downloaded binary.

There is actually a small research community around precisely this problem - how to make compilation reproducible.

Having said that, a manual comparison of a downloaded binary and a self-compiled one can detect added/modified code, so it would be risky for someone offering binaries and the source code to hide something in the binaries, as this can be detected.

But then there is also the problem of trusting the compiler, as already mentioned...

It is a difficult problem to create the exact same binaries on two different machines. The TOR project does this as regular part of their build. There is a description how they do it. Debian and Fedora seem to have projects making this possible for this distributions, but they are in the early stages. It doesn't seem like there is any work done in Ubuntu.

To reproduce a Ubuntu binary Package you would need to reproduce the environment it was created in as closely as possible. To start with that, you first need to find out where and how this packages where compiled. It doesn't look like that information is easy to find.

• Details on what specific? – Josef Jul 9 '14 at 18:22
• Ignore me, confused with a different post :) – Tim Jul 9 '14 at 18:25

Checking with Ubuntu's MD5. If the MD5 you get from your files matches the one published by Ubuntu then no one has tampered with the binaries inbetween.

• This is not OP's question. He's worried about the source code being distributed by Ubuntu not being the same as the binaries being distributed by Ubuntu. In other words, they say "this is the source," but the source they are building the binaries from actually has some extra NSA-introduced code. He's not worried that the binaries have been tampered with after build. – John Chrysostom Jul 10 '14 at 19:06
• The OP posted: "How can I verify myself that those binaries are in fact from the original source code from Ubuntu?" The answer is for that question. The other one is ridiculous, who can know if the Linux kernel has not been tampered by anyone (NSA or who ever?) easy, download the code, read it and once you are happy compile it yourself. Other than that, my answer is for the question I have copied in the begining of this comment. – YoMismo Jul 14 '14 at 6:31
• You have not answered the question you quoted. Using the MD5 only lets him verify that the binaries on his computer match the binaries on the server. They DO NOT let him verify that the binaries he downloaded were compiled from the source Ubuntu provides. Now, I agree that his questions is ridiculous for the reason you (and others) have stated. But that WAS his question. – John Chrysostom Jul 14 '14 at 11:56

That is a Hard job , I think trust here is better than this complicated job. But the question Can you trust ?

Because Open source software gives many freedoms for users to change in the code , you cant trust anyone .

Lets make a scenario for this purpose , i wanna check that my Ubuntu == source code , wait Why you don't try to compare packages to their source ?

1. Build a binary package for Ubuntu from source .
2. compared the self-built binary package with the one published by the distribution.