View Single Post
Posts: 726 | Thanked: 345 times | Joined on Apr 2010 @ Sweden
#18
Originally Posted by ysss View Post
Unless packages are uploaded as src to an autobuild+package facility, is there a quick and simple way to verify that the binaries submitted are bulid from the referenced sources?
I'm not really sure if I understand your question but if you're asking if there is a way to link a specific source to a specific binary, the general answer is "No".

An easy way to handle this is for the creator to compile it, make a hash (MD5, SHA1) and publish it together with the source code. This is often used to check that packages that are to be installed came through download intact.

Then you can yourself check the binary that you've downloaded.

But, keep in mind that you need to trust the hash maker and that the same source can be compiled differently, but correctly, by two different compilers.