14

When developer creates a binary from the code and puts to releases section, does it match the code in a restrictive way so there is no chance that malicious code is compiled into it? How Github ensures this? Is there a validation mechanism or compiling pipeline applied by Github?

Thanks

| improve this question | |
New contributor
laimison is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • 2
    Even if GitHub applied a compiling pipeline (and they have one, GitHub Actions, which you can use to check out the repository, build it, and save artifacts as releases all within GitHub's infrastructure), you can't meaningfully assure that the binary is what you'd expect because you don't know what all went into it. The build script could install a third-party component which installs another third-party component which downloads something from a random web server which interferes with the build in a malicious way. – Zach Lipton 7 hours ago
  • 2
    Even if it could be guaranteed to match the code, you still have to trust the repository. See en.wikipedia.org/wiki/Underhanded_C_Contest. – ceejayoz 6 hours ago
32

There are no guarantees that the uploaded artefacts match the source code in the repository. That something is on GitHub does not mean that it can be trusted. You need to also trust the maintainers of that repository.

| improve this answer | |
  • 9
    +1 from me. Worse, in many cases, you cannot even rebuild the binary from the sources and meaningfully compare your binary with the distributed one; hence. eg. Debian's Reproducible Builds efforts. For an excellent voyage around the appropriate limits for paranoia in this particular direction, read Ken Thompson's seminal paper Reflections on Trusting Trust. – MadHatter♦ 18 hours ago
  • 4
    In fact, I've seen a repo that doesn't have any sources (only a README), and the releases section has the binary-only code. – Ruslan 12 hours ago
  • 1
    @Ruslan many people use Github Releases and now Github Packages to distribute things held elsewhere - for example, I have many repositories where the only contents is a README and perhaps a Dockerfile, but the Packages feature on that repo is used to distribute a built container image compiled from many sources and different repositories. – Moo 8 hours ago
  • Isn't this true of anything on the Internet? – user17915 8 hours ago
  • 2
    @user17915: I suppose in theory there could be a code hosting service where the downloadable artefacts have to be generated by the service's own CI environment. So, you only have to trust the service that the binaries were generated from the source, you don't have to trust the repo owner. But I'm not sure this would be super-valuable, because (a) under-handed code is not that difficult, especially since most users never read the code, so in practice you'd probably still have to trust the repo owner that the source is good; (b) enforcing the build tools would be a hurdle for users. – Steve Jessop 7 hours ago

Your Answer

laimison is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.