[upofadown]

The difference is that the operation of the Crypto AG machines was secret. Only the employees of the company had access. The operation of some contemporary systems is available to the whole world in the form of source code. In some cases multiple entities with no particular connection actually work on that source code. The trick is in insuring that the source code is the only thing that contributed to the program you are running.

As a fairly extreme example, consider what it would take to backdoor GnuPG. It is distributed to multiple platforms/OSes, most of which allow anyone to check both the signatures on the source code and then recreate the binaries.

[TheSpiceIsLife]

If you use GnuPG on a system with any unverified-build and audited for security compliance software / hardware, can you be certain GnuPG is behaving as expected?

[dane-pgp]

For what it's worth, Debian's gnupg2 package builds reproducibly[0]. That doesn't mean that the Debian-specific patches[1] have necessarily been widely audited though, even if the upstream code itself has enough eyes on it.

Also it's not exactly clear how an end user would discover that the Debian package they installed had a different checksum from the version that was reproducibly built, or if sufficiently independent teams are re-creating these checksums and have a way of notifying people of discrepancies.

[0] https://tests.reproducible-builds.org/debian/rb-pkg/unstable...

[1] https://sources.debian.org/src/gnupg2/2.2.20-1/debian/patche...

[upofadown]

You don't need the other software on a system to be audited for security compliance. You just need to know that it is not actively malicious. So any run of the mill Linux or BSD not running proprietary software.