Securing the Source: Why Every Package You Install Deserves More Trust Than You Give It

Every time you run sudo apt install, or any other package manager command, software lands on your system almost magically. No one questions it. Everyone trusts it. But should they?

This session covers why package managers were introduced, how the Linux packaging ecosystem evolved, and how trust was baked in through GPG signing and verification. Then it gets uncomfortable what happens when that trust breaks. Real incidents like the XZ utils backdoor showed the world that the package distribution chain itself can become the attack vector.

This session extends my previous talk on Linux package manager internals, delivered at a DevOps community meetup, now focusing on the security and trust layer that every developer using open source software should understand. Slides from the previous talk will be attached below as reference.

• A brief intro to how package managers evolved and why they were introduced

• How GPG signing and package verification works under the hood

• How real world supply chain attacks happened through the package chain

• Why monitoring what you install matters more than most developers think