Not really, individual package developers don't have as much inmediate control over the repository's state as they do with NPM. Packages go through a review by one of the trusted developers and sometimes automated QA and testing (including as of late reproducibility testing, i.e. does the source match the binary?), before being uploaded to the repository.

If you can't trust the team behind the distro, then sure, your supply chain is compromised, but it's significantly less likely for a single package developer to cause any damage, as all the big distros have rather extensive policy and procedures to prevent such things.

I use Gentoo which uses portage the package manager and the way portage works is it pulls source then compiles. Source is rarely checked by everyone. Small packages exist as well. Many Linux distro simply barrow binaries from "trusted" sources. The entire eco system is really a deck of cards.

> Many Linux distro simply barrow binaries from "trusted" sources.

The crappy ones maybe. Proper distros build everything from source.

This is a false equivalence brought up every time anyone mentions how vulnerable the npm/gems/pip ecosystems are to supply chain attacks.

Linux code is always reviewed before deployment, goes through many eyeballs, people are careful about this. The same is not true of npm, or any of the other services (as this event clearly shows).

Eh that's not true. I use Gentoo so trust me most things are run by little dictators of their own little fiefdoms.

I'm talking about not just the kernel but all the various other things from libraries to servers to tools and everything in between.

OK, but none of those little fiefdoms are "Linux".

I literally said the Linux stack which includes everything from the kernel to init to libs. You can't run just the kernel.

It's still a false equivalence. You'll agree that all the important bits of the Linux Stack are audited and reviewed by multiple people, right?

Parts of the Linux stack equivalent to colors and faker are carefully audited and reviewed by multiple people? That sounds to me like elevating them to important bits in a false equivalence.

When it comes to security (among other things), one simply cannot say that all the important bits are in the kernel. If that were the case, there would not be an issue to discuss here.

Lol hell no. You're joking right?

any operating system, really, if you want to play that game

Unless you're using LFS, of course.

The problem you describe isn't Linux, it's Linux Distributions.

Where would you draw the line?

Source packages are available, and if the binaries don't match the code a distro would soon be outed a la "many eyes" thinking.

We have to trust some or none.

Get the top off that chip, see if the factory put an extra core in for the NSA (IME).

No, serious Linux distributions audit their code.