I agree that doing everything I mentioned manually is hard, that's again why I said that distributions have solved this problem and made it easy.
[edit] also that protects you against malware injecting binaries in an executable when compiling it, but not from malware injecting code into the source code of the executable.
Publisher. A user could (if they were really paranoid) rebuild the packages locally, with two or three commands.
> Also that protects you against malware injecting binaries in an executable when compiling it, but not from malware injecting code into the source code of the executable.
You can download the source code that OBS used (both as a src RPM generated by the builder and the OBS repo that the builder was given read-only access to), and OBS supports cryptographic signatures of the originating source (with gpg-offline keys to avoid WoT attacks). If your developers are using sane source control practices (use GPG keys for every commit, but especially tags) then you are protected against that too.
Of course, reproducible builds is something that would solve this problem even better (protecting against attacks on OBS that cause it to add source that are not in the repo). As a side point, our threat model doesn't fully trust the nodes compiling the software so such attacks are fairly limited in scope (but I'm not a developer of OBS so I'm really not the right person to be asked these questions).
Many things could go wrong with this (mainly attacks on the expected results db, it should be replicated) but the idea should work.
- (N-1) machines build a new Debian package.
- The (N-1) results are fetched by the fourth party.
- The Nth party checks whether the build results are identical.
- The Nth party signs the result with GPG on a machine that is not connected.
- The signed package is distributed.
An attacker would need to compromise either: (1) N-1 build machines; (2) the offline machine used for signing packages; or (3) the upstream source.
I consider (3) to be the most serious thread. But in this scenario, only the distribution packagers need to inspect the source changes. In the common scenario where you download from a vendor (e.g. the Transmission or CCleaner website), every user has to inspect a binary blob.
Another possibility would be to have strong sandboxing for applications. An application could still participate in DDoS attacks, etc. But it would at least not encrypt/destroy your data.
tl;dr: reproducible builds are an extremely important development and Debian (and other distributions participating in this initiative) should be commended for their work!
is there any distros out there now that are source based like Gentoo with more friendly defaults?
And reproducible builds are a work in progress.