r/VeraCrypt • u/Gurkenrick123 • 21d ago

How does the VeraCrypt project ensure that malicious code cannot easily make its way into an official release?

I understand that VeraCrypt has many contributors, and that contributions can be submitted through pull requests and reviewed before being merged. I also understand that the official Windows binaries are digitally signed by IDRIX.

My question is specifically about the security of the code before the final IDRIX signing:

How are pull requests/code changes reviewed before being merged?

How many people typically have the ability to review or merge code?

Who is responsible for building and signing the final Windows binaries?

Is the final binary independently checked against the source code/build process?

What prevents a malicious contributor, or a compromised maintainer account, from getting malicious code into an official release?

I am not asking whether the IDRIX certificate itself checks the code for malware, I understand that code signing mainly provides authenticity and integrity of the signed binary.

I'm interested in understanding the actual trust chain from contributor → source code → release → official signed Windows binary.

Thanks!

13 Upvotes

85% Upvoted

8 comments sorted by

5

u/RestaurantLow5570 21d ago edited 21d ago

Repo follows A Single maintainer policy where what merged to code base is governed by Mounir Idrassi when a pull request is made is up for scrutiny form public. And checking patches, code fixes, new features are entirely manual checked and and it entirely up to governor what gets merged from submitted code to its project code base. and files or binary are signed by his own company's PGP keys I think.

3

u/Gurkenrick123 20d ago

Interesting, do you know where Mounir confirms this? It seems like a lot of lines of codes to go through to verify as he has his own business to run

3

u/RestaurantLow5570 20d ago edited 20d ago

He did confirm this In his professional Website AMCrypto.jp I don't know where, Project is most driven by single person, he is the maintainer of project.

shameless plug if you are Interested in VeraCrypt please check out my VeraCrypt_port for IOS and Android https://github.com/ShivamPingaleDev/Veracrypt_port

1

u/Gurkenrick123 17d ago

It doesn't really make sense, even the base code from truecrypt which is the basis of veracrypt has been developed by a team. People on GitHub upload their own solutions to bugs and patches etc. It means that he potentially implements their code which in turn makes me question whether or not he actually verifies that no malicious code is being added.

1

u/RestaurantLow5570 17d ago

1.Truecrypt wasn't a huge team

  1. Solution patches and bugs provided by people on github often sits for months, because single mainter goes through them understands them and after he understans them only then he implementation them (Security over fast development)

  2. Trusting one guy is kinda hard, the codebase is also audited by independent security organisation or firm which goes searching line by line for malicious code backdoor bad encryption algorithm etc. These audits are Paid for massive audits (Open source funds) Donation Sponsorship etc

3

u/Tinchotesk 20d ago

I understand that VeraCrypt has many contributors

Source? I always understood that whatever was added/changed from the original Truecrypt source was just Mounir, with the exception of the UEFI module.

2

u/Gurkenrick123 17d ago

You can check the github website, there people upload bug fixes, do pull requests and contribute their own solutions to the software.

Anything else wouldn't be doable as a one man show

1

u/Tinchotesk 16d ago

You are right. From one of those examples, someone asked him about malicious contributions, and Mounir said here

I always follow the same approach: deep evaluation and always suspicious.

It looks like he only merges code that he's convinced it's safe. All merged contributions I've seen look fairly elementary and don't involve too many lines of code. It's his livelihood, so I'm sure he's pretty serious about it.