Checks source code goes though before added to repository?

[Lechium]

Hi,

I am curious of what kind of checks and tests does source code go though before it is added to the repository?

Let me elaborate. Say I am a part of a small project working on say a gui text editor for config files, or something like that. The project has to be compiles (emerged) and ran with root permissions (it edits config files after all). At that if I hide any malicious code to it (i.e. make it run 'rm -fr /bin' on 20th use, or such) it can slaughter users system. Yeah, at that point my name is ruined, and I'm blacklisted, but still I had caused massive damage to (potentially) many computers. And what if someone from my team snuck it in without me knowing, or it was a virus that got attacjed to it somehow, etc etc etc.

Point I am trying to make is that average Gentoo user puts a lot of trust into his packages being clean of malware. What kind of steps does Gentoo development comunity takes to make sure that few assholes will not take advantage of this trust?

wbr,
Victor

[alistair]

Trojaned Compilers = Backdoored Binaries

I suppose this could be the biggest security issue with opensource. How do u know that the compiler on the live cd you used didnt add backdoors thru every program it compiled. Even if you had the source code for the compiler (or believed you did) u still couldn't confirm that the source code is exactly the same as the compiled compilers orginal source code.


ps. Would it be funny if someone at Microsoft did this to their kernel compiler

[Genone]

[Sven Vermeulen]

Gentoo uses the project's source code. The security team can perform audits, but this happens when there is ground for such an audit, not randomly.

There is always a chance that the project's source code is malicious, in which case the Gentoo installed software will be malicious as well. However, if the jack-I-want-to-destroy-the-world code is added after we made the ebuild, Portage will find that the code has been altered. This is a security mechanism to protect users from malicious mirrors and such.

If you don't use ~arch, chances are that such code is discovered before it hits stable
_________________
Please add "[solved]" to the initial topic title when it is solved.

[omp]

[codergeek42]

[BlackEdder]

[codergeek42]

[Sven Vermeulen]

[playfool]

If you insert bad code in an open source project and it's discovered the fix is simple - we dispatch ESR with his huge gun collection to set an example.

[EzInKy]