How does one verify an app is running of its published code source?
How can users confidently verify that a FOSS application is running from its published source code? Is there a easy way to check this, or is this based of checksum and hashes?
When it comes to iOS, Here’s a cool guide for reverse engineering .ipas. github.com/ivRodriguezCA/RE-iOS-Apps . I would think applying a sort of comparison of the static analysis with a published app against the compiled repos version would be a possible first step
Although I haven’t used it myself yet, Guix actually has a feature that lets you “challenge” the build servers to see if your builds match the pre-built binaries (the command being aptly named guix challenge).
Do you use Guix? I’ve found it quite interesting and I’d love to try it out one day. The thing is, I need the mainline Linux kernel for some proprietary drivers.
For starters, you’re not required to install Guix System in order to use the Guix package manager itself; the manual provides instructions for installing it on top of your existing system here if you want to use it but not fully commit (you can do this with Nix too).
Guix allows for adding new sources to pull packages from using channels. The nonguix channel provides the Linux kernel - blobs and all - as well as other stuff that won’t be upstreamed, like Steam and NVIDIA drivers.
I recommend this helpful series by System Crafters, which includes a few guides on installing Guix and Guix System with the full Linux kernel.
Just a note if you plan on installing Guix on top though, since I didn’t realize you might be running NixOS: according to this discussion, you’d need to take a different route to get Guix working.
As the article/SO answer posted by cwagner tells you you effectively can't, because a "trojan" could be injected at many different levels and even self-compiling the source code depends on some compiler binary that you have to get from somewhere (build your own compiler, you tell me, but what do you use to compile THAT?).
In practice for most people the correct answer is "get the binary from your distributions normal repository". By using a given distribution you already implicitly trust that distribution (because if you don't, why use it?), so non-core software from their repository should also be considered trustworthy (at least in the sense that no additional trojans were introduced that aren't in the source).
That doesn't really help with Windows, though. There your best bet is to get a binary that's from as close to the original authors themselves. Ideally from their project home page themselves.
There is, its called a Linux distribution repository or F-Droid for Android.
Why would you trust a badge on github if you don’t trust the original author to not tamper with the binaries? The only way is to either built from source yourself or get the binaries from a trusted 3rd party that does that.
AFAIK most Linux distributions don't (yet) have fully reproducible builds (simply because it's a HUGE ask). For Debian for example, it's continued ongoing work: https://wiki.debian.org/ReproducibleBuilds
That is an unrelated topic. By using a distro you are already implicitly trusting them over the random author that publishes binaries on their repo or so.
Yes, I agree with the trust and that it's effectively equivalent for most users. But I read OPs reply as asking specifically for "a more automatic way of checking (that it was build from source cleanly)".
I think expecting that this has already been cleanly solved years ago is not unreasonable (until you realize how many rabbit holes this whole topic has to go down to work well).
Add comment