5

Let's assume I want to use an open-source software, the developer says that the software is open-source and provides the source code.

Now my question is, how can I be 100% sure that the given binary files are compiled from the given source code?

Of course I could always compile the source code of every open source project I want to make use of but that is quite time-consuming if I want to use more than just one program or even not possible if I want to use for example an iPhone and do not have a macbook.

So do I have to trust the developer that the binary files are truly from that source code or is there another way?

For example: Let's assume I want to use the messenger app Signal. How can I be sure that there is not a built-in backdoor in the binary files which is not in the provided source code?

Improve this question
6
  • 1
    If you don't want to do the check that would tell you: You can't.
    – Polygnome
    Commented Jan 11, 2021 at 1:48
  • 2
    Are you asking how to verify if a project is open source, or how to verify that a given compiled binary matches the source code presented alongside it? You seem to be asking the latter, which is a wholly different question than the first (which is in your title).
    – Flater
    Commented Jan 11, 2021 at 2:22
  • 5
    Cross-site duplicate: opensource.stackexchange.com/questions/2737/…
    – Bart van Ingen Schenau
    Commented Jan 11, 2021 at 7:01
  • 4
    You're not supposed to trust anyone that a binary was created from a certain codebase. That's near-impossible to do, and it's not the point of Open Source. You're supposed to compile the code base yourself and use that binary.
    – Kilian Foth
    Commented Jan 11, 2021 at 7:30
  • @Flater: I took the freedom to change the question title to make it match the question.
    – Doc Brown
    Commented Jan 11, 2021 at 14:03

2 Answers 2

Reset to default
6

how can I be 100% sure that the given binary files are compiled from the given source code?

The only way is to compile it yourself using the exact same environment that has been used to build the given binary, and compare. This is easier if the open source project has setup a CI/CD chain. That said, if you manage to compile, you no longer need pre-built binaries.

So do I have to trust the developer that the binary files are truly from that source code or is there another way?

No, you have to trust the distribution channel, be it the download section of the source code repository or the official software distribution channel (RedHat repo, Apple's App Store or whatever).

How can I be sure that there is not a built-in backdoor in the binary files which is not in the provided source code?

You can't. And you can't be sure that there is not a built-in backdoor in the source code itself. I mean, you'll never have the time to check every piece of open source software that you want to use.

Improve this answer
4
  • 1
    If the OS project has a CI/CD chain or build pipeline that runs in an observable way, couldn't you use the artifact from that build? Then you don't necassarily have to trust the developer, but instead you have to trust the organisation that provides the platform for the build pipeline.
    – bdsl
    Commented Jan 11, 2021 at 11:44
  • 1
    If this is a scenario where we trust the authors but not the 3rd party distributors of the binaries, one thing that can help is the authors publishing a hash digest of the binaries. You can then compare the (trusted) hash digest against your local copy of the binaries. As long as a suitable hashing algorithm is used, it should be practically impossible for the distributor to insert malware.
    – Jasmijn
    Commented Jan 11, 2021 at 14:25
  • Thanks for your answer! In the last phrase you said that I can't check every piece of open source software. But don't you think that I can trust to popular os software? Well I thought that they shall be secure because they are peer reviewed. And the difference in this trust is that peer-reviewing is the result from many independent people and not just one person.
    – Harun
    Commented Jan 11, 2021 at 14:36
  • 3
    Peer review is not the ultimate solution. According to latest GitHub security report, it takes an average of 4 years before a vulnerability is discovered in open source software. Fortunately, most vulnerabilities are just mistakes and not attacks.
    – mouviciel
    Commented Jan 11, 2021 at 15:44
3

The keyword you'd want to put in the search engine here is "reproducible build". What this means is that whenever you build the same version of the software under a well known configuration, the build output is always bit-to-bit identical. Anyone can rebuild the software and then attest that the published build are built from the same source.

Some security sensitive software like Torbrowser and OpenSSL have made attempts at reproducible build to varying degree of success, and some Linux Distros have made a large proportion of the packages in their repositories reproducible, but supporting this generally requires a significant investment into the software ecosystem.

Improve this answer
1
  • Not all build tools produce reproducible builds. Maven for example had a long way to go until builds were reproducible. Nonetheless, reproducible builds are the best way to generate trust...
    – Polygnome
    Commented Jan 11, 2021 at 10:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.