This could be awkward on sites such as SourceForge where the actual sources are allowed to be change - though nominally only by those with commit access. How could you tell a backdoor installation (via a hacked admin account) from an normal authorized upload?

Just checksumming or signing wouldn't be enough to discriminate between the two cases. I suppose this is another argument for developers to keep their own source tree in a non-public (preferably normally non connected) place to diff against the public tree.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/462/13036#13036