Chain of trust There is a lot of talk about secure boot recently
– mostly because of the windows 8 certification requirements.
Secure boot gives makes it harder (but not impossible) for
malware such as rootkits to start at boot time and then control
the operating system. It creates a chain of trust from the
hardware to the bootloader to the operating system, so criminals
cannot break that chain. However, if we want to protect open
source software against criminals there is a different chain of
trust that we need to protect: the chain from upstream
developers to the end-user. There are quite a few bits and
pieces in place already, but some essential parts are missing.
In august 2009, for example, the web server from the
squirrelmail webmail project was hacked, and two plugins were
compromised with malware. It was lucky that the hack was
discovered very quickly so little harm was done, but that could
have been much worse. Most open source projects use a version
control system for their source code that involves