Is there a VirusTotal for source code?

[mappo]

One of the most held-up reasons for why open source is good, is something along the lines of
"1000s of smart people have reviewed the code to make sure there are no security/privacy issues"

And I agree ... but:
The vast majority of us ignore the "download source code" link and just go for the already-compiled executable.
How can I be sure that the executable was compiled with the same source code that the 1000s of smart people reviewed?

A service like VirusTotal for source code could compile the source code and compare the result to the executable on the site.
Of course, compiling something like Firefox takes quite a while, so I guess some kind of hashing would be required.

And now I ask the 1000s of smart listeners to SN:
1. is this an issue?
2. are there solutions?

 

[PHolder]

A great many projects build their binaries out in the public in the same way that they share their code publicly. Of course they rely on other binary tools, which you have to hope were built without a hidden agenda themselves. There seems to be a great need for trust in the industry... and it's unclear how much trust is well placed. Not that everyone is bad, because I think a majority are not, but a lot of corners do get cut, and not every developer is a star in his or her field. Potential security vulnerabilities could be created by a less than competent developers who do not get the necessary helpful code reviews and encouragement to do better.

 

[mappo]

A great many projects build their binaries out in the public in the same way that they share their code publicly. Of course they rely on other binary tools, which you have to hope were built without a hidden agenda themselves. There seems to be a great need for trust in the industry... and it's unclear how much trust is well placed. Not that everyone is bad, because I think a majority are not, but a lot of corners do get cut, and not every developer is a star in his or her field. Potential security vulnerabilities could be created by a less than competent developers who do not get the necessary helpful code reviews and encouragement to do better.

Please elaborate on what "build their binaries out in the public" means. I've never heard that phrase before.

Still, it comes down to publishing (at least) two links on the project's site; one to the source code and one to the pre-compiled binary. What ways are there to guarantee that the latter is the result of the former?

 

[PHolder]

Please elaborate on what "build their binaries out in the public"

Some sites, like Github, have a build tool that you can invoke to build your public binaries from your public source. The binaries should thus be assured to represent the source code, assuming you're willing to trust the tools employed are not back-doored (for example, there is the theory of a compiler backdoored to inject mal-code into a binary as it's being compiled: reference)

 

[mappo]

That's really interesting. I had no idea, thanks!
So generally (very generally), projects on github are more reliable (at least in this very specific aspect) than those that roll their own website.

The issue of malicious compilers is separate and not specific to open source imhbco*.

But I still wonder about a VirusTotal-like service for code. Are there any such tools, or has Github solved it?


*in my humble but correct opinion