4 ms·
> Linux package managers are looking like one of the only straightforward ways to distribute applications securely. Linux distributions package what is release
by mhurron 11y ago
> Linux package managers are looking like one of the only straightforward ways to distribute applications securely.
Linux distributions package what is released upstream. If upstream is compromised, so is the Linux package.
- r0muald 11y agoNo, Linux distributions offer packages and operating systems that are the result of painstaking work in which all upstream code is reviewed, patched for any inconsistency, and often blocked from going into public archives until known bugs are fixed.
- regularfry 11y agoThat's... optimistic.
- cyphar 11y agoThat's how OpenSUSE works. Debian too AFAIK.
- regularfry 11y agoIt's the aspirational ideal behind how these projects work.
- owaislone 11y agoActually, most have scripts that pull the upstream source and build new binaries without any manual intervention. It is the responsibility of the package maintainer to review every change in code.
- finnn 11y agoGenerally, Linux package maintainers grab the upstream source, while most of these compromises seem to be of the binaries. And, of course, the maintainers generally review the changes before publishing them