Re:Nixos-unstable’s ISO_minimal.x86_64-Linux is 100% reprodu...
by bigiain on Sunday June 20, 2021 @07:00PM
(#27574606)
Building from source also doesn’t buy you very much, if you haven’t inspected/audited the source.
The upthread hypothetical of a compromised package manager equally applies to a compromised source repo.
_Maybe _ you always check the hashes? _Maybe_ you always get the hashes from a different place to the code? _Maybe_ the hypothetical attacker couldn’t replace both the code you download and the hash you use to check it?
(And as Ken pointed out decades ago, maybe the attacker didn’t fuck with your compiler so you had lost before you even started.)
The upthread hypothetical of a compromised package manager equally applies to a compromised source repo.
_Maybe _ you always check the hashes? _Maybe_ you always get the hashes from a different place to the code? _Maybe_ the hypothetical attacker couldn’t replace both the code you download and the hash you use to check it?
(And as Ken pointed out decades ago, maybe the attacker didn’t fuck with your compiler so you had lost before you even started.)