[lmm]

> 1) A packager downloads a random tarball off the internet, often over HTTP and/or unsigned and unverified.

Then they're being remiss in their duties.

> 2) The packager uploads the same tarball to the distro build system (you trust them, right?)

Yes, I do.

> 3) The packager's script for building the program or library is executed by the build server (you trust all of the packagers, right? they have implicit root access to your machine during pkg install.)

There is at least traceability here. There are a large number of packagers for my distro, true - but they are required to personally sign for the packages they upload. If one of them turned out to be malicious, I don't think this would be without consequence.

[sanderjd]

Honest questions: what do you think the consequences would be, and how do you think they would be enforced?

[zimbatm]

It would certainly make a big fuss.

First the identity of that person would be stigmatized to a point where it wouldn't be usable anymore to gain trust to other projects. Publishing rights certainly would get revoked for that user.

Then all packages published by him/her will need to be analyzed for further exploits and discussions would happen to avoid future similar issue. If possible a patch/fix would get published by the distribution.

[lmm]

I think they'd be banned from the project. If it looked to be malicious, I can see a lawsuit happening, though that would probably be a slow process and end in a settlement of some sort. Packager identities are verified against legal identity documents; depending on your threat model that may or may not be an effective barrier - a nation state can probably afford to burn a few identities, but regular criminals not so much.

[rquirk]

It might not be malice on the part of the packager. It could be that their machine is deliberately compromised.